Skip to main content
cvebuzz

CVE mentions, exploit signals, and PoC evidence in one fast public view.

CVE detail

CVE-2025-8356

In Xerox FreeFlow Core version 8.0.4, an attacker can exploit a Path Traversal vulnerability to access unauthorized files on the server. This can lead to Remote Code Execution (RCE), allowing the attacker to run arbitrary commands on the system.

CVSS 9.8 · CriticalBuzz score 27.6

Buzz score

Why this CVE is surfacing

Buzz score total 27.6

This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.

Buzz score components · mention 16.1 · diversity 11.5 · KEV 0.0 · OTX 0.0 · PoC 0.0
Mention score
16.1
4 evidence mentions in the snapshot
Diversity score
11.5
3 sources across 2 categories
KEV score
0.0
No KEV entry observed
OTX score
0.0
0 OTX pulses
PoC score
0.0
0 repos · best confidence N/A
Best PoC traction
0
Maximum stars on a matched PoC repo

Why it matters now

Mention timeline

Total mentions
0
within the 30d window
Peak daily
0
highest bucket

Evidence

Source links by recency

Newest mentions first
4 source links · newest first
  • Xerox fixed path traversal and XXE bugs in FreeFlow CoreSecurity Affairs

    Xerox patched two serious flaws in FreeFlow Core, path traversal and XXE injection, that allowed unauthenticated remote code execution. Xerox addressed two serious flaws, respectively tracked as CVE-2025-8355 and CVE-2025-8356, in FreeFlow Core. The vulnerabilities are a path traversal (CVE-2025-8355) and XXE injection (CVE-2025-8356), which allowed an unauthenticated attacker to achieve remote code execution. FreeFlow […]

    newssecurityaffairs.comAug 18, 2025, 7:08 AM
  • Vulnerabilities in Xerox Print Orchestration Product Allow Remote Code ExecutionSecurityWeek

    Path traversal and XXE injection flaws allowing unauthenticated remote code execution have been patched in Xerox FreeFlow Core.

    newswww.securityweek.comAug 14, 2025, 1:47 PM
  • From Support Ticket to Zero DayHorizon3.ai

    Examining a Critical Vulnerability in Xerox FreeFlow Core

    exploithorizon3.aiAug 13, 2025, 12:59 PM
  • CVE-2025-8356Horizon3.ai

    Xerox FreeFlow Core Remote Code Execution Vulnerability

    exploithorizon3.aiAug 11, 2025, 9:41 PM

Exploit code

Public exploit repository references

Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.

0 repository references · best confidence N/A · max 0 stars
No public PoC repositories have been matched yet.

Related records

Similar CVEs

6 related CVEs with shared weakness or product evidence
  • CVE-2026-73291

    Seerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby. Prior to version 3.4.0, Seerr's ImageProxy in server/lib/imageproxy.ts uses the upstream…

    CVSS 7.1 · High
    3 mentions
  • CVE-2026-46581

    In Eclipse Mojarra versions 2.3 and following, URL handing in `DefaultFaceletFactory` does not properly sanitize and/or block remote URLs, allowing an attacker to specify a URL to…

    CVSS 7.5 · High
    2 mentions
  • CVE-2026-59866

    Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.5, Kiota emitted x-ms-kiota-info clientClassName and clientNamespaceName values without identifier or path sani…

    CVSS 9.3 · Critical
    4 mentions
  • CVE-2026-13014

    A vulnerability in Thales CERT "Suspicious" application =< 1.3.4 allows a remote and unauthenticated attacker to execute arbitrary code and arbitrarily overwrite writable applicat…

    CVSS 9.2 · Critical
    1 mention
  • CVE-2026-53951

    Copier is a library and CLI app for rendering project templates. In versions 9.5.0 through 9.15.1, the `trust` setting's prefix match (`copier/_settings.py`) compares the template…

    CVSS 8.8 · High
    2 mentions
  • CVE-2026-14439

    A path traversal vulnerability exists in the Git Service component shared by Altium Enterprise Server and Altium 365. The service accepts a sequence of post-clone file-manipulatio…

    CVSS 9.4 · Critical
    1 mention