Two serious vulnerabilities were patched recently by Xerox in its FreeFlow Core print orchestration platform.
According to pentesting company Horizon3, whose researchers discovered the flaws, FreeFlow Core is affected by an XXE injection flaw (CVE-2025-8355) and a path traversal issue (CVE-2025-8356).
The researchers discovered that the vulnerabilities could allow an unauthenticated, remote attacker to execute arbitrary code on affected FreeFlow Core instances.
The potential impact has been demonstrated with an exploit that placed a webshell on the targeted system.
FreeFlow Core is designed for prepress automation workflows and it’s typically used by organizations with large-scale printing operations, including universities, packaging and marketing firms, and even government agencies, according to Horizon3.
“Given the nature of the product, FreeFlow Core installations have a lot of moving parts and require relatively open access and availability, which combined with the fact that print jobs of this kind generally contain pre-public information around marketing campaigns makes this an ideal target for attackers,” the security firm warned.
The vulnerabilities were reported to Xerox in June and they were patched on August 8, when the vendor published an advisory to inform customers about the availability of patches. Fixes are included in FreeFlow Core version 8.0.5.
Earlier this year, researchers disclosed vulnerabilities in Xerox VersaLink multifunction printers that could allow attackers to retrieve authentication credentials, which could then be used for lateral movement.
Related: New Vulnerabilities Expose Millions of Brother Printers to Hacking
Related: Printer Company Procolored Served Infected Software for Months
Related: Critical Vulnerability Found in Canon Printer Drivers
Related: Fortinet, Ivanti Release August 2025 Security Patches
