GHSA-r8w2-w357-9pjv

XDocReport affected by a Server-Side Template Injection (SSTI) vulnerability

Source: GitHub Advisory Database (reviewed) Critical CVE-2025-64087

Packages

Ecosystem	Package	Affected	Fixed in
Maven	fr.opensagres.xdocreport:fr.opensagres.xdocreport.template.freemarker	< 2.2.0	2.2.0

Details

As written in the advisory (Markdown source, shown as plain text).

A Server-Side Template Injection (SSTI) vulnerability in the FreeMarker component of opensagres XDocReport v1.0.0 to v2.1.0 allows attackers to execute arbitrary code via injecting crafted template expressions.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2025-64087 advisory
https://github.com/opensagres/xdocreport/pull/705 web
https://github.com/opensagres/xdocreport/commit/3b35d105e5ae2006bcaa2b07563188efc466711d web
https://github.com/AT190510-Cuong/CVE-2025-64087-SSTI- web
https://github.com/opensagres/xdocreport package
https://hackmd.io/@cuongnh/BJEnw7SAlg web
https://hackmd.io/@cuongnh/SkQvhEf0lx web