Xdocreport vulnerabilities

2 known vulnerabilities in Xdocreport from Opensagres. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  Xdocreport: Improper Restriction of XML External Entity Reference

  CVE-2025-65482Jan 20, 2026Opensagres

  An XML External Entity (XXE) vulnerability in opensagres XDocReport v0.9.2 to v2.0.3 allows attackers to execute arbitrary code via uploading a crafted .docx file.

• 9.8 Critical severity

  Xdocreport: Improper Neutralization of Special Elements Used in a Template Engine

  CVE-2025-64087Jan 20, 2026Opensagres

  A Server-Side Template Injection (SSTI) vulnerability in the FreeMarker component of opensagres XDocReport v1.0.0 to v2.1.0 allows attackers to execute arbitrary code via injecting crafted template expressions.