OpenText Flipper CVE-2025-8050

Exploitation targets the OpenText Flipper component that accepts an externally controlled file name or path (CWE-73) and fails to constrain it to the intended directory, letting an unauthenticated actor (PR:N) read files hosted on the server. Key limiting factors: the vector requires passive user interaction (UI:P in CVSS 4.0), so an attacker generally depends on a victim initiating the crafted request; impact is rated Low (VC:L), implying only partial or restricted file disclosure rather than full arbitrary-file read; and exposure is confined to deployments running the affected Flipper 3.1.2. No non-default configuration prerequisite is stated in the available data.

This is a medium-severity, lower-priority issue rather than an urgent one. The vendor-supplied CVSS 4.0 base score is 5.3 (Medium), driven by a network attack vector with low complexity and no privileges (AV:N/AC:L/PR:N) but tempered by required user interaction (UI:P) and only Low impact across confidentiality, integrity and availability (VC:L/VI:L/VA:L). EPSS corroborates low urgency at 0.29% (20th percentile), and there is no CISA KEV listing and no public exploit identified at time of analysis - so exploitation evidence is absent. The 4.0 supplemental/threat metrics are mixed: Automatable is Yes (AU:Y) and the vendor's own Urgency tag is Green, meaning the vendor itself treats this as low urgency despite the flaw being scriptable. One internal inconsistency to verify: the description characterizes the flaw purely as read-only file access (a confidentiality concern), yet the vendor vector also asserts Low integrity and availability impact (VI:L/VA:L) - the description does not substantiate integrity/availability effects, so the true impact is likely confidentiality-only and the I/A scoring should be confirmed with OpenText.

An attacker crafts a request to an OpenText Flipper 3.1.2 endpoint supplying a manipulated file path/name parameter containing directory-traversal sequences, causing the application to return a file outside the intended directory on the server. Because user interaction is required (UI:P), the attacker likely needs a victim to trigger the malicious request (e.g., following a crafted link), and the disclosed content is limited (VC:L). No public exploit code has been identified at time of analysis.