Threats affecting pkg:maven/org.opensagres/xdocreport

A Server-Side Template Injection (SSTI) vulnerability exists in the Velocity template engine configuration used by xdocreport versions 0.9.2 up to but not including 2.2.0. This flaw allows attackers to execute arbitrary code by submitting crafted expressions to the template engine. The vulnerability is critical with a CVSS score of 9.8, indicating high impact on confidentiality, integrity, and availability.

CVE-2025-64087 is a critical Server-Side Template Injection (SSTI) vulnerability in the FreeMarker component used by opensagres XDocReport versions 1.0.0 to 2.1.0. This flaw allows unauthenticated remote attackers to execute arbitrary code on affected systems by injecting malicious template expressions. The vulnerability has a CVSS score of 9.8, indicating a high impact on confidentiality, integrity, and availability without requiring user interaction or privileges. Although no known exploits are currently in the wild, the ease of exploitation and severity make it a significant threat. European organizations using XDocReport for document generation or reporting are at risk, especially those in sectors with high reliance on automated document processing.