This vulnerability allows a malicious user to supply crafted XML containing external entity references, resulting in a server‑side request forgery (SSRF). The attacker can force the affected service to reach arbitrary internal or external resources, potentially exfiltrating data or enabling further compromise. The weakness is an XML External Entity (CWE‑611) that can be abused for SSRF (CWE‑918).

Xerox FreeFlow Core, versions up to and including 8.0.7, are affected. The vendor recommends upgrading to version 8.1.0 to remediate the issue.

With a CVSS base score of 7.5 the vulnerability is considered high. The EPSS indicates a very low exploitation probability (<1%) and it is not listed in the CISA KEV catalog, but the presence of SSRF capabilities still warrants prompt action. Exploitation is possible from remote input where the attacker can control XML payloads—likely via any service that accepts XML input. Only basic network connectivity is required to trigger the SSRF.