critical9.8
CVE-2025-64087
XDocReport affected by a Server-Side Template Injection (SSTI) vulnerability
Impact
A Server-Side Template Injection (SSTI) vulnerability in the FreeMarker component of opensagres XDocReport v1.0.0 to v2.1.0 allows attackers to execute arbitrary code via injecting crafted template expressions.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | fr.opensagres.xdocreport:fr.opensagres.xdocreport.template.freemarker | < 2.2.0 | 2.2.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Opensagres | Xdocreport | from 1.0.0 through 2.1.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/AT190510-Cuong/CVE-2025-64087-SSTI-
- https://github.com/opensagres/xdocreport
- https://github.com/opensagres/xdocreport/pull/705
- https://hackmd.io/@cuongnh/BJEnw7SAlg
- https://hackmd.io/@cuongnh/SkQvhEf0lx
- https://github.com/advisories/GHSA-r8w2-w357-9pjv
- https://nvd.nist.gov/vuln/detail/CVE-2025-64087
- https://github.com/opensagres/xdocreport/commit/3b35d105e5ae2006bcaa2b07563188efc466711d