CVE-2024-55926: High File Access Flaw in Xerox Workplace Suite

CVE-2024-55926 is a high severity flaw (CVSS 7.6) in Xerox Workplace Suite. Improper validation of request headers allows arbitrary file read, upload and deletion on the server. Xerox says it is mitigated in Workplace Suite version 5.6.701.9, so update to that release or newer and review the other CVEs in the same bulletin.

What's affected

The record names Xerox Workplace Suite and describes file read, upload and deletion on the server through crafted header manipulation. Xerox security bulletin XRX25-002, dated 23 January 2025, covers a batch of seven CVEs from CVE-2024-55925 through CVE-2024-55931. It states that these issues have been mitigated in Workplace Suite version 5.6.701.9.

The bulletin lists the file handling weakness in two lines: arbitrary file deletion and arbitrary file read, both through header manipulation. CVE-2024-55925 in the same bulletin covers an API security bypass and arbitrary file upload through header manipulation. The bulletin does not give a lower bound for affected versions, so assume any release older than 5.6.701.9 is in scope until Xerox says otherwise.

How to check if you're exposed

Find the installed Workplace Suite version in the product's administration console or in the installed programs list on the server that runs it. If it is older than 5.6.701.9, you have work to do.

Next, find out who can reach the server. The CVSS vector in the record shows network access with low privileges required, so the first questions are which networks can connect to the web interface and whether any of them are untrusted. A print management server that is reachable from guest Wi-Fi or from the internet is a very different risk from one on a locked down management VLAN.

If you cannot upgrade immediately, check the bulletin for any interim guidance and restrict network access to the service.

What to do now

1. Confirm the installed Workplace Suite version on every server, including test instances.
2. Upgrade to 5.6.701.9 or later, following Xerox's own install guidance and taking a backup first.
3. Limit which networks can reach the Workplace Suite web interface and APIs to print clients and administrators.
4. Read bulletin XRX25-002 in full. It lists related issues, including token handling and secrets exposure, that are fixed in the same release.
5. Look at the server's file system and web logs for unexpected files or deleted content from before the update.
6. Note that the bulletin says one item, token storage in session storage, will be fixed in a future release, and keep an eye on later bulletins.

Why it matters

The record classes the flaw under CWE-22 (path traversal) and CWE-434 (unrestricted upload of a dangerous file type). Both are failures to validate input that arrives from the client. Here the input is request headers, which developers often treat as trusted because browsers set them. Any client can send any header, so the server has to validate them as it would a form field.

File read, write and delete on a server is a strong position. Reading can expose configuration and secrets. Writing can plant content the server will later use. Deleting can break the service. The vector in the record shows high availability impact, which fits the deletion capability. The KEV flag in the record is false, so there is no catalog entry for active exploitation, but a print management server holds credentials and documents, which is reason enough to patch promptly.

Quick check

Sources

• Xerox Security Bulletin XRX25-002

Last reviewed: 19 October 2026.