XDocReport affected by a Server-Side Template Injection (SSTI) vulnerability

CRITICAL 9.8CVE-2025-64087 · GHSA-r8w2-w357-9pjv · Published 20/01/2026 · updated 17/06/2026

Package	Affected versions	Patched versions
fr.opensagres.xdocreport:fr.opensagres.xdocreport.template.freemarker Maven	`< 2.2.0`	`2.2.0`
xdocreport opensagres	`≥ 1.0.0, ≤ 2.1.0`	No fix yet

Description

A Server-Side Template Injection (SSTI) vulnerability in the FreeMarker component of opensagres XDocReport v1.0.0 to v2.1.0 allows attackers to execute arbitrary code via injecting crafted template expressions.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2025-64087 · ADVISORY
opensagres/xdocreport#705 · WEB
opensagres/xdocreport commit 3b35d10 · WEB
AT190510-Cuong/CVE-2025-64087-SSTI- · WEB
opensagres/xdocreport · PACKAGE
hackmd.io/@cuongnh/BJEnw7SAlg · WEB
hackmd.io/@cuongnh/SkQvhEf0lx · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free