CVE-2026-2252

The record

An XML External Entity (XXE) vulnerability allows malicious user to perform Server-Side Request Forgery (SSRF) via crafted XML input containing malicious external entity references. This issue affects Xerox FreeFlow Core versions up to and including 8.0.7.  Please consider upgrading to FreeFlow Core version 8.1.0 via the software available on -  https://www.support.xerox.com/en-us/product/core/downloads

Affected packages

Related vulnerabilities

• CVE-2026-89260 MoguBlog through 6.2 contains an XML external entity injection vulnerability in the… CWE-611
• CVE-2026-84941 An information disclosure vulnerability in the SAML Single Sign-On (SSO) functionality of… CWE-611
• CVE-2026-79572 An XXE (XML External Entity) vulnerability in the level-rule module of Distribution… CWE-611
• CVE-2026-19614 The API is prone to XML external entity (XXE) injection. CWE-611
• CVE-2026-71375 Improper restriction of XML external entity reference vulnerability in Cosminexus… CWE-611
• CVE-2026-76958 SAP Integration Suite does not sufficiently validate XML documents accepted from… CWE-611
• CVE-2026-17444 IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and… CWE-611
• CVE-2026-17443 IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and… CWE-611