What is CVE-2026-2251?

CVE-2026-2251 is a critical-severity vulnerability in Xerox Freeflow Core, classified under Path Traversal. CVSS score: 9.8/10. Published 2026-02-27.

How severe is CVE-2026-2251?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Path Traversal in Xerox Freeflow Core

CVE-2026-2251

Improper limitation of a pathname to a restricted directory (Path Traversal) vulnerability in Xerox FreeFlow Core allows unauthorized path traversal leading to RCE. This issue affects Xerox FreeFlow Core versions up to and including 8.0.7. Please consider upgrading to FreeFlow Core version 8.1.0 via the software available on - https://www.support.xerox.com/en-us/product/core/downloads https://www.support.xerox.com/en-us/product/core/downloads

Vulnerability class: Path Traversal (Directory Traversal)

EPSS: 0.004 (31.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Xerox Freeflow Core — versions 0
Xerox Freeflow_core

Weakness classification (CWE)

CWE-22 — Path Traversal

References

10b61619-3869-496c-8a1e-f291b0e71e3f (Vendor Advisory)

Frequently asked questions

What is CVE-2026-2251?: CVE-2026-2251 is a critical-severity vulnerability in Xerox Freeflow Core, classified under Path Traversal. CVSS score: 9.8/10. Published 2026-02-27.
How severe is CVE-2026-2251?: Critical severity. CVSS v3 base score is 9.8 out of 10.