Arbitrary file upload, deletion and read through header manipulation

published 2025-01-23 21 mo ago modified 2026-06-17 4 mo ago also EUVD-2024-52850

cvss: 7.6; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.4%; EPSS 0.4% chance of exploitation in 30 days, percentile 38%
public exploits: 0; none known

A vulnerability found in Xerox Workplace Suite allows arbitrary file read, upload, and deletion on the server through crafted header manipulation. By exploiting improper validation of headers, attackers can gain unauthorized access to data

Patch / fix

fixed in 1

Xerox Xerox Workplace Suite 5.6.701.9

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 21 mo ago (2025-01-23)

Exploit prediction

0.44% chance of exploitation in the next 30 days, higher than 38% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.6	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
NVD	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Xerox Xerox Workplace Suite

Classification

Weakness

CWE-434 Unrestricted Upload of File with Dangerous Type
CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

securitydocs.business.xerox.com /wp-content/uploads/2025/01/Xerox-Security-Bulletin-XRX25-002-for-Xerox%C2%AE-WorkplaceSuite%C2%AE.pdf
vendor-advisory

Sources

CVE List CVE-2024-55926
NVD CVE-2024-55926

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary