Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

XDocReport: Malicious Word Files Can Execute Arbitrary Code

CVE-2025-65482 · published 9 months ago
Summary

XDocReport, a Java library for generating reports, has a vulnerability that lets attackers execute malicious code on your server if they upload a specially crafted Word document. This could allow them to take control of your server and potentially steal sensitive information. Update to the latest version of XDocReport to fix this issue.

What to do
  • Update opensagres fr.opensagres.xdocreport:fr.opensagres.xdocreport.document to version 2.0.4.
Affected software
Ecosystem VendorProductAffected versions
maven opensagres fr.opensagres.xdocreport:fr.opensagres.xdocreport.document >= 0.9.2, < 2.0.4
Fix: upgrade to 2.0.4
– opensagres xdocreport >= 0.9.2, <= 2.0.3
cpe:2.3:a:opensagres:xdocreport:*:*:*:*:*:*:*:*
Original advisory text
An XML External Entity (XXE) vulnerability in opensagres XDocReport v0.9.2 to v2.0.3 allows attackers to execute arbitrary code via uploading a crafted .docx file.
An XML External Entity (XXE) vulnerability in opensagres XDocReport v0.9.2 to v2.0.3 allows attackers to execute arbitrary code via uploading a crafted .docx file.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-611XML External Entity (XXE)
Timeline
Published20 Jan 2026
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-7jc7-g598-2p64 · GHSA
CVE-2025-65482 · NVD
CVE-2025-65482 · OSV
Track software like this
Free during beta