Xerox Corporation has issued urgent security updates for its FreeFlow Core software following the discovery of two critical vulnerabilities that expose enterprise environments to severe threats. The vulnerabilities, tracked as CVE-2025-8355 and CVE-2025-8356, allow unauthenticated remote attackers to execute arbitrary code on affected systems and conduct server-side request forgery (SSRF) attacks. According to Horizon3.ai, the flaws were identified after unusual behavior was detected in a customer environment, prompting a deeper investigation that uncovered the vulnerabilities. 'Thank you to Jimi Sebree with Horizon3.ai for working with the Xerox Team to identify and mitigate these vulnerabilities,' Xerox stated in their communications.
The vulnerabilities specifically affect FreeFlow Core version 8.0.4 and were disclosed in Security Bulletin XRX25-013 on August 8, 2025. Xerox has categorized the severity of these vulnerabilities as 'IMPORTANT' and has urged users to upgrade to version 8.0.5, which contains the necessary security fixes. The first vulnerability, CVE-2025-8355, arises from an XML External Entity (XXE) processing flaw, allowing attackers to manipulate entity declarations through improperly sanitized XML input. This flaw can lead to SSRF attacks, enabling adversaries to craft XML payloads that force the server to initiate unintended requests to internal services or external targets.
The second vulnerability, CVE-2025-8356, is a path traversal flaw that may lead to remote code execution. By exploiting poorly validated file path inputs, an attacker could access directories outside the intended scope of the application, potentially allowing them to execute arbitrary code on the host. The implications of these vulnerabilities are significant, particularly for organizations that rely on FreeFlow Core for large-scale printing operations.
In response to the vulnerabilities, Xerox has emphasized the urgency of applying the updates. The security community has also reacted, with experts warning that the public availability of proof-of-concept exploits significantly lowers the barrier for attackers. 'Organizations should prioritize patching these vulnerabilities to protect their systems,' advised a cybersecurity analyst. As of now, users of FreeFlow Core are strongly encouraged to upgrade to the patched version immediately to mitigate potential exploitation risks.
The ongoing situation highlights the critical need for organizations to maintain robust security practices, including timely application of patches and monitoring for unusual system behavior. As stated in the security bulletin, 'Failure to apply the updates may result in severe security breaches.'
