Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

opensagres/xdocreport

              master @ e7a7431
            

Fixes

CVEs

CRITICAL

Peak severity

Highlights

SSTI: 1 prior fix. Scrutinize any change in this area.

FreemarkerTemplateEngine.java: most-fixed (1 issue). Treat as high-risk during review.

3 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Server-Side Template Injection: Insecure default configuration of the FreeMarker template engine allowed arbitrary class resolution, enabling remote code execution via template expressions (CVE-2025-64087). Developers must enforce restricted class resolvers on all instances.

Server-Side Template Injection: Velocity template rendering allowed execution of unsafe JDK operations. Hardening requires configuring the SecureUberspector class to restrict execution of dangerous Java reflection methods.

XML External Entity (XXE): XML parsers used during document preprocessing failed to disable external entities, permitting XXE injection via malicious document uploads such as .docx files (CVE-2025-65482).