Moole Vulnerability Database

Find real vulnerabilities before they ship

Critical

CVE-2025-64087

A Server-Side Template Injection (SSTI) vulnerability in the FreeMarker component of opensagres XDocReport v1.0.0 to v2.1.0 allows attackers to execute arbitrary code via injecting crafted template expressions.

VectorNETWORK

PublishedJan 20, 2026, 16:16

Published Bycve@mitre.org

Base Score

Score9.8

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

fr.opensagres.xdocreport:fr.opensagres.xdocreport.template.freemarker(Maven)02.2.0N/A

References

https://github.com/AT190510-Cuong/CVE-2025-64087-SSTI-
https://github.com/opensagres/xdocreport
https://github.com/opensagres/xdocreport/pull/705
https://hackmd.io/@cuongnh/BJEnw7SAlg
https://hackmd.io/@cuongnh/SkQvhEf0lx

Weakness Type

CWE-1336

CVSS Metrics

Base Score

9.8

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Base SeverityCritical

Version

3.1

Attack Vector (AV)

NETWORK