Vulnerability Description
A Server-Side Template Injection (SSTI) vulnerability in the FreeMarker component of opensagres XDocReport v1.0.0 to v2.1.0 allows attackers to execute arbitrary code via injecting crafted template expressions.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Opensagres | Xdocreport | >= 1.0.0, <= 2.1.0 |
Related Weaknesses (CWE)
References
- https://github.com/AT190510-Cuong/CVE-2025-64087-SSTI-Broken Link
- https://github.com/opensagres/xdocreportProduct
- https://github.com/opensagres/xdocreport/pull/705Issue TrackingThird Party Advisory
- https://hackmd.io/@cuongnh/BJEnw7SAlgPermissions Required
- https://hackmd.io/@cuongnh/SkQvhEf0lxPermissions Required
FAQ
What is CVE-2025-64087?
CVE-2025-64087 is a vulnerability with a CVSS score of 9.8 (CRITICAL). A Server-Side Template Injection (SSTI) vulnerability in the FreeMarker component of opensagres XDocReport v1.0.0 to v2.1.0 allows attackers to execute arbitrary code via injecting crafted template ex...
How severe is CVE-2025-64087?
CVE-2025-64087 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2025-64087?
Check the references section above for vendor advisories and patch information. Affected products include: Opensagres Xdocreport.