CVE-2025-64087: XDocReport FreeMarker SSTI RCE Vulnerability

CVE-2025-64087 Overview

A Server-Side Template Injection (SSTI) vulnerability has been identified in the FreeMarker component of opensagres XDocReport, affecting versions 1.0.0 through 2.1.0. This vulnerability allows remote attackers to execute arbitrary code on affected systems by injecting crafted template expressions into documents processed by the vulnerable library.

Server-Side Template Injection vulnerabilities occur when user-controlled input is embedded into server-side templates without proper sanitization. In the case of XDocReport, the FreeMarker template engine processes document templates that may contain malicious expressions, enabling attackers to break out of the template sandbox and execute arbitrary Java code on the underlying server.

Critical Impact

This vulnerability enables unauthenticated remote code execution through malicious template expressions, potentially allowing complete system compromise.

Affected Products

• opensagres XDocReport v1.0.0 through v2.1.0
• Applications utilizing XDocReport's FreeMarker template processing functionality
• Document generation services that process untrusted template input

Discovery Timeline

• 2026-01-20 - CVE-2025-64087 published to NVD
• 2026-01-21 - Last updated in NVD database

Technical Details for CVE-2025-64087

Vulnerability Analysis

The vulnerability exists within XDocReport's integration with the FreeMarker template engine. XDocReport is a Java library used for generating documents (such as Word, OpenDocument, and PDF files) from templates. When processing document templates, the FreeMarker component evaluates embedded expressions without adequate restrictions on dangerous operations.

FreeMarker templates support powerful expression syntax that, when not properly sandboxed, can be leveraged to access Java's runtime environment. An attacker who can influence the content of templates processed by XDocReport can inject malicious FreeMarker expressions that execute arbitrary code when the template is rendered.

The vulnerability is classified under CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine), which describes scenarios where template engines process untrusted input without proper sanitization or sandboxing.

Root Cause

The root cause of this vulnerability is insufficient input validation and inadequate sandboxing of the FreeMarker template engine within XDocReport. The library fails to properly restrict dangerous template expressions that can access Java's reflection APIs and runtime execution capabilities. When user-controlled data flows into template contexts, attackers can craft payloads that escape the intended template processing boundaries.

Attack Vector

This vulnerability is exploitable over the network without requiring authentication or user interaction. An attacker can exploit this vulnerability by:

1. Identifying an application using vulnerable versions of XDocReport for document generation
2. Crafting a malicious document template containing SSTI payloads targeting FreeMarker
3. Submitting the malicious template to the application for processing
4. The FreeMarker engine evaluates the injected expressions, executing arbitrary Java code

Typical attack scenarios include document generation services that accept user-uploaded templates, report generation systems, and any application that merges user data with document templates using XDocReport.

The attack leverages FreeMarker's built-in features to access Java objects and invoke methods that can lead to arbitrary command execution. Common exploitation techniques involve using FreeMarker's new() built-in or accessing the freemarker.template.utility.Execute class to run system commands.

For detailed technical analysis and proof-of-concept information, refer to the HackMD Security Analysis Document and the GitHub Pull Request Discussion.

Detection Methods for CVE-2025-64087

Indicators of Compromise

• Unusual process spawning from Java applications utilizing XDocReport
• Unexpected network connections originating from document processing services
• Suspicious command execution patterns following document template uploads
• Log entries showing FreeMarker template parsing errors with unusual expression patterns
• Presence of encoded or obfuscated content in uploaded document templates

Detection Strategies

• Monitor application logs for template processing errors or exceptions related to FreeMarker
• Implement content inspection for uploaded documents containing suspicious template expressions such as <#assign>, ?new(), or references to Execute class
• Deploy web application firewalls (WAF) with rules to detect SSTI payloads in document uploads
• Use runtime application self-protection (RASP) solutions to detect and block template injection attempts

Monitoring Recommendations

• Enable verbose logging for document processing operations in applications using XDocReport
• Monitor for unusual Java process behavior including unexpected child processes or network activity
• Implement file integrity monitoring on document template directories
• Set up alerts for failed template parsing attempts that may indicate exploitation attempts

How to Mitigate CVE-2025-64087

Immediate Actions Required

• Identify all applications and services using opensagres XDocReport versions 1.0.0 through 2.1.0
• Review the GitHub Pull Request #705 for patch details and apply updates when available
• Implement input validation to reject document templates containing suspicious FreeMarker expressions
• Restrict document template uploads to trusted users only until patching is complete

Patch Information

Organizations should monitor the opensagres XDocReport GitHub repository for official security patches addressing this vulnerability. The GitHub Pull Request #705 contains discussion related to addressing this security issue.

Review the HackMD Technical Documentation for additional remediation guidance and technical details.

Workarounds

• Configure FreeMarker with a restrictive TemplateClassResolver to prevent instantiation of dangerous classes
• Implement a whitelist of allowed template expressions and reject templates containing unauthorized constructs
• Run document processing services in isolated containers or sandboxed environments with minimal privileges
• Consider using alternative template engines with stronger security defaults for processing untrusted input

# Example: Restricting FreeMarker class resolver in application configuration
# Add to your XDocReport configuration to limit template capabilities
# Note: Consult XDocReport documentation for exact implementation details

# For containerized deployments, restrict process capabilities
docker run --cap-drop=ALL --cap-add=NET_BIND_SERVICE \
  --read-only --tmpfs /tmp \
  --security-opt=no-new-privileges \
  your-xdocreport-application