OpenText Flipper CVE-2025-8048

Exploitation requires the attacker to use Flipper's document-storage feature: they must be able to submit/store a local file path and then request it back by its stored document ID - i.e., abuse of the stored-document download function rather than an unauthenticated request against a default endpoint. Limiting factors: the workflow implies an application user account with permission to create stored documents (contradicting the vendor's PR:N), and only version 3.1.2 is listed as affected. The impact is confined to reading files accessible to the Flipper service account; write or code-execution impact is not described.

This is a medium-severity information-disclosure flaw (vendor CVSS 4.0 base 5.3) with low real-world urgency. Exploitation signals are weak: EPSS is 0.29% (20th percentile), there is no CISA KEV listing, and no public exploit code was identified - mapping to 'no public exploit identified at time of analysis.' The vendor-supplied CVSS 4.0 vector claims AV:N/PR:N (network, unauthenticated), which per the precision rule would read as unauthenticated; however, the description states a user must 'submit a stored local file path' and then retrieve it via a stored document ID, which strongly implies the attacker must already be an authenticated application user able to create/store documents. This is a conflict: CVSS asserts PR:N but the described workflow implies authenticated access - verify privilege requirement with OpenText. The vector also sets VI:L and VA:L (integrity/availability impact), which is unusual for a read-only file-download primitive and may overstate impact; the realistic impact is confidentiality (arbitrary file read). Net: a genuine but low-priority issue - patch in normal cycle, not an emergency.

An application user stores a document whose file path points to a sensitive local file on the server (e.g., a configuration or credential file) instead of a legitimate document, then issues a download request referencing that stored document ID and retrieves the targeted file. No public proof-of-concept exploit is known. The network attack vector with low complexity makes the request itself trivial, but the attacker needs the ability to submit stored paths, limiting it to users with application access.