CVE-2025-64087

Description

A Server-Side Template Injection (SSTI) vulnerability in the FreeMarker component of opensagres XDocReport v1.0.0 to v2.1.0 allows attackers to execute arbitrary code via injecting crafted template expressions.

Risk Information

Base Score

9.8

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score

Exploitation Probability

0.103

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2025-64087 are fixed in Opensagres - fr.opensagres.xdocreport.template.freemarker 2.2.0	Windows
Vulnerabilities CVE-2025-64087 are fixed in Opensagres - fr.opensagres.xdocreport.template.freemarker for Linux 2.2.0	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234