PatchTheCVECVE-2026-2251: Improper limitation of a pathname to a restricted directory (Path Traversal) vulnerability in Xerox FreeFlow C
CVE-2026-2251 is a critical-severity flaw (CVSS 9.8) affecting freeflow core. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Improper limitation of a pathname to a restricted directory (Path Traversal) vulnerability in Xerox FreeFlow Core allows unauthorized path traversal leading to RCE. This issue affects Xerox FreeFlow Core versions up to and including 8.0.7. Please consider upgrading to FreeFlow Core version 8.1.0 via the software available on - https://www.support.xerox.com/en-us/product/core/downloads https://www.support.xerox.com/en-us/product/core/
Why this priority
- Critical severity
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 9.8 (Critical) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.4% (top 61%) |
| CISA exploited list | No |
| Weakness | CWE-22 |
| Published | 2026-02-27 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-2251?
freeflow core: upgrade to 8.1.0. Exact commands for each OS are on this page.
Is CVE-2026-2251 being exploited?
CVE-2026-2251 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-2251 affect?
CVE-2026-2251 affects freeflow core. Severity is critical (CVSS 9.8). Improper limitation of a pathname to a restricted directory (Path Traversal) vulnerability in Xerox FreeFlow Core allows unauthorized path traversal leading to RCE. This issue affects Xerox FreeFlow Core versions up to and including 8.0.7.
How urgent is CVE-2026-2251?
Priority 49/100. Critical severity; Remotely exploitable, no login, no user action
Software pages
Related CVEs
- CVE-2026-2252 HIGH 7.5 UPGRADE An XML External Entity (XXE) vulnerability allows malicious user to perform Server-Side Request Forgery (SSRF)
- CVE-2025-8356 CRITICAL 9.8 DOWNGRADE In Xerox FreeFlow Core version 8.0.4, an attacker can exploit a Path Traversal vulnerability to access unautho
- CVE-2025-8355 HIGH 7.5 DOWNGRADE In Xerox FreeFlow Core version 8.0.4, improper handling of XML input allows injection of external entities
- CVE-2024-47559 HIGH 7.6 DOWNGRADE Authenticated RCE via Path Traversal
- CVE-2024-47558 HIGH 7.6 DOWNGRADE Authenticated RCE via Path Traversal