The vulnerability in Xerox FreeFlow Core allows an attacker to perform path traversal, bypassing directory restrictions, and gain the ability to execute arbitrary code. The weakness is identified as CWE-22, which permits attackers to escape designated directories and interact with the underlying filesystem. Compromise of the application can lead to full system takeover, data exfiltration, and persistent footholds, severely impacting confidentiality, integrity, and availability of the host running the software.

The affected product is Xerox FreeFlow Core, versions up to and including 8.0.7. The company has released version 8.1.0 with the fix. Administrators should verify the current software version and assess whether they are on a vulnerable build.

The severity is high with a CVSS score of 9.8, yet the EPSS score is listed as less than 1%, indicating a very low probability of exploitation under current conditions. The vulnerability is not present in the CISA Known Exploited Vulnerabilities catalog. The likely attack vector is remote over the network through any exposed FreeFlow Core interface that accepts file paths, as no explicit entry mechanism is defined in the description; thus the attack is inferred to be network based.