9.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-64087

CVE-2025-64087: XDocReport affected by a Server-Side Template Injection (SSTI) vulnerability

A Server-Side Template Injection (SSTI) vulnerability in the FreeMarker component of opensagres XDocReport v1.0.0 to v2.1.0 allows attackers to execute arbitrary code via injecting crafted template expressions.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-64087

CVE-2025-64087:

9.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
fr.opensagres.xdocreport:fr.opensagres.xdocreport.template.freemarker	maven	< 2.1.0	2.1.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Server-Side Template Injection (SSTI) in the FreeMarker component of XDocReport. The analysis of the patch commit 3b35d105e5ae2006bcaa2b07563188efc466711d reveals that the fix involves hardening the FreeMarker configuration. Specifically, it sets the NEW_BUILTIN_CLASS_RESOLVER_KEY to "safer", which restricts the ability of templates to instantiate arbitrary classes, a common vector for SSTI in FreeMarker.

The code modification occurs in the setFreemarkerConfiguration method of the fr.opensagres.xdocreport.template.freemarker.FreemarkerTemplateEngine class. This configuration is then used by the process method of the same class, which is responsible for rendering the templates. The added security test case, FreemarkerTemplateEngineSecurityTestCase.java, confirms that the process method is the entry point for the exploit, as it attempts to process a malicious template string. Therefore, the process method is the vulnerable function, as it's the one that executes the untrusted template code with an insecure configuration in vulnerable versions.

Vulnerable functions

fr.opensagres.xdocreport.template.freemarker.FreemarkerTemplateEngine.process

template/fr.opensagres.xdocreport.template.freemarker/src/main/java/fr/opensagres/xdocreport/template/freemarker/FreemarkerTemplateEngine.java

The `process` method is responsible for rendering FreeMarker templates. Prior to the patch, the FreeMarker engine was configured insecurely, allowing template authors to instantiate arbitrary Java classes using the `?new()` built-in. An attacker could craft a malicious template that, when processed by this method, would lead to Server-Side Template Injection (SSTI) and arbitrary code execution. The `process` method is the function that directly handles and executes the unsafe template content.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.