CVE-2025-64087: XDocReport affected by a Server-Side Template Injection (SSTI) vulnerability
A Server-Side Template Injection (SSTI) vulnerability in the FreeMarker component of opensagres XDocReport v1.0.0 to v2.1.0 allows attackers to execute arbitrary code via injecting crafted template expressions.
Published Jan 20, 2026 · Updated Feb 12, 2026
Affected packages
fr.opensagres.xdocreport:fr.opensagres.xdocreport.template.freemarker
- Ecosystem
- Maven
- Affected
- < 2.2.0
- Fixed in
- 2.2.0
- Check
mvn dependency:tree -Dincludes=fr.opensagres.xdocreport:fr.opensagres.xdocreport.template.freemarker
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
A Server-Side Template Injection (SSTI) vulnerability in the FreeMarker component of opensagres XDocReport v1.0.0 to v2.1.0 allows attackers to execute arbitrary code via injecting crafted template expressions.
Credited to kevinleturc.
References
- https://nvd.nist.gov/vuln/detail/CVE-2025-64087
- https://github.com/opensagres/xdocreport/pull/705
- https://github.com/AT190510-Cuong/CVE-2025-64087-SSTI-
- https://hackmd.io/@cuongnh/BJEnw7SAlg
- https://hackmd.io/@cuongnh/SkQvhEf0lx
- https://github.com/opensagres/xdocreport/commit/3b35d105e5ae2006bcaa2b07563188efc466711d
- https://github.com/advisories/GHSA-r8w2-w357-9pjv
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology