CVE-2025-8356
Published: 08 August 2025
Summary
CVE-2025-8356 is a critical-severity Path Traversal (CWE-22) vulnerability in Xerox Freeflow Core. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 10.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
Xerox FreeFlow Core version 8.0.4 contains a path traversal vulnerability (CWE-22) that also enables code injection (CWE-94). The flaw permits an attacker to access arbitrary files on the underlying server and ultimately execute commands, reflected in its CVSS 3.1 score of 9.8 with network attack vector, no authentication, and full confidentiality, integrity, and availability impact.
Unauthenticated remote attackers can exploit the issue over the network to read sensitive files and achieve remote code execution, allowing them to run arbitrary commands on the affected system without user interaction.
The vendor’s security bulletin for FreeFlow Core 8.0.5 addresses the vulnerability, and a technical write-up from Horizon3 details how the issue progressed from a support ticket to public disclosure as a zero-day. The associated EPSS score has remained flat at 0.0478 with no material increase observed after publication.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-23999
Vulnerability details
In Xerox FreeFlow Core version 8.0.4, an attacker can exploit a Path Traversal vulnerability to access unauthorized files on the server. This can lead to Remote Code Execution (RCE), allowing the attacker to run arbitrary commands on the system.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Path traversal in public-facing Xerox FreeFlow Core directly enables T1190 exploitation; escalation to unauthenticated RCE enables arbitrary command execution via T1059.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents path traversal attacks by validating and sanitizing user-supplied inputs at system entry points to block unauthorized file access.
Addresses the specific flaw in Xerox FreeFlow Core by identifying, reporting, and applying timely remediation such as patches from the vendor bulletin.
Enforces logical access controls to information and system resources, mitigating unauthorized file access even if path traversal inputs are not fully sanitized.