Xerox patched two vulnerabilities in its FreeFlow Core print orchestration platform. The flaws, identified as CVE-2025-8355 (XXE injection) and CVE-2025-8356 (path traversal), could enable remote, unauthenticated attackers to execute arbitrary code on affected systems. An example exploit demonstrated the capability to place a webshell on targeted systems. FreeFlow Core is used primarily by large printing operations, such as universities and agencies. These vulnerabilities were reported in June and patched on August 8 with updates to version 8.0.5.
"Given the nature of the product, FreeFlow Core installations have a lot of moving parts and require relatively open access and availability, which combined with the fact that print jobs of this kind generally contain pre-public information around marketing campaigns makes this an ideal target for attackers."
"The potential impact has been demonstrated with an exploit that placed a webshell on the targeted system."
Collection
[
|
...
]