CVE-2025-64087: Opensagres Xdocreport

Critical severity, CVSS 9.8. EPSS: 0.6% chance of exploitation in the next 30 days.

A Server-Side Template Injection (SSTI) vulnerability in the FreeMarker component of opensagres XDocReport v1.0.0 to v2.1.0 allows attackers to execute arbitrary code via injecting crafted template expressions.

Affected products

• Opensagres Xdocreport: from 1.0.0, up to and including 2.1.0

Published 2026-01-20. Last modified 2026-06-17.