CVE-2025-64087: Critical Server-Side Template Injection Vulnerability in XDocReport FreeMarker Component
Summary
CVE-2025-64087: XDocReport affected by a Server-Side Template Injection (SSTI) vulnerability. Affects fr.opensagres.xdocreport:fr.opensagres.xdocreport.template.freemarker versions < 2.1.0. Fixed in 2.1.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
XDocReport is an open-source library that facilitates the generation of documents from templates using various template engines. The FreeMarker component allows users to create dynamic content by merging data with templates. However, versions 1.0.0 to 2.1.0 of the FreeMarker component are susceptible to a critical vulnerability that can lead to severe security risks.
Vulnerability Detail
The vulnerability is a Server-Side Template Injection (SSTI) flaw found in the FreeMarker component of XDocReport. It allows attackers to inject crafted template expressions, which can lead to the execution of arbitrary code on the server. This can result in unauthorized access to sensitive data, system compromise, and potential exploitation of the server environment. The vulnerability arises from improper handling of user input in template processing, making it a significant security concern for applications relying on this library.
How To Fix
Latest published version: 2.2.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.1.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing input validation and sanitization to mitigate the risk of template injection. Ensure that any user-generated input is properly escaped before being processed by the FreeMarker templates.
Conclusion
The Server-Side Template Injection vulnerability in the FreeMarker component of XDocReport poses a significant risk to applications using affected versions. It is crucial to update to version 2.1.0 or later to mitigate this risk. Additionally, employing input validation can serve as a temporary workaround while transitioning to the patched version.
See every vulnerability recorded for fr.opensagres.xdocreport:fr.opensagres.xdocreport.template.freemarker →
FAQ
Server-Side Template Injection (SSTI) is a vulnerability that occurs when an application allows users to inject template code that is executed on the server, potentially leading to arbitrary code execution.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By checking your pom.xml file on the Vulert playground, you can quickly assess if your application is impacted.
Exploitation of this vulnerability can lead to unauthorized access to sensitive data, server compromise, and the ability for attackers to execute arbitrary commands on the server.
Yes, a patch is available in version 2.1.0 of the XDocReport FreeMarker component. It is recommended to upgrade to this version to mitigate the vulnerability.
The CVSS score for this vulnerability is 9.8, indicating a critical level of severity.
