CVE-2025-65482 XDocReport affected by an XML External Entity (XXE) vulnerability
Attackers can execute arbitrary code by uploading a crafted .docx file to applications using the XDocReport library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-65482?
CVE-2025-65482 is a critical vulnerability in n/a, published on 20 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An XML External Entity (XXE) vulnerability in opensagres XDocReport v0.9.2 to v2.0.3 allows attackers to execute arbitrary code via uploading a crafted .docx file.
Weakness: CWE-611
Which versions are affected by CVE-2025-65482?
2 open source packages ship an affected version, including fr.opensagres.xdocreport:fr.opensagres.xdocreport.document. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
fr.opensagres.xdocreport:fr.opensagres.xdocreport.document Maven | From 0.9.2 | 2.0.4 |
fr.opensagres.xdocreport:fr.opensagres.xdocreport.document Maven | From 0.9.2 | 2.0.4 |
Products include Opensagres Xdocreport.
How do I fix CVE-2025-65482?
Upgrade fr.opensagres.xdocreport:fr.opensagres.xdocreport.document to 2.0.4 or later.
Is CVE-2025-65482 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-65482 exists.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in n/a
Sources
Also known as GHSA-7jc7-g598-2p64.