OpenText Flipper CVE-2025-8051
MEDIUMAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Flipper endpoint over network
-
DeliverySupply absolute path in request
-
ExploitInduce user interaction to trigger
-
ExecutionBypass directory restrictions
-
ImpactRead arbitrary server files
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path traversal prevention
|
| Exploitation Conditions | Exploitation requires the OpenText Flipper 3.1.2 web interface to be network-reachable and depends on passive user interaction (CVSS UI:P) to trigger the request that carries an absolute file path; no authentication is required (PR:N). The attacker supplies an absolute path (CWE-35 absolute path traversal) to retrieve files the server process can read. Limiting factors: the required user interaction prevents fully automated/wormable exploitation, impact is bounded to files readable by the Flipper service account, and only version 3.1.2 is listed as affected. |
| Impact | This is a moderate-severity information-disclosure issue, not a top-tier priority. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:P, VC:L/VI:L/VA:L) scores 5.3 and indicates a network-reachable, low-complexity, unauthenticated flaw that nonetheless requires passive user interaction (UI:P) to trigger, which meaningfully constrains automated mass exploitation. EPSS reinforces the low urgency: 0.39% probability at the 31st percentile signals little predicted exploitation activity. There is no CISA KEV listing and no public proof-of-concept referenced in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' One internal inconsistency to verify: the vendor vector asserts integrity and availability impact (VI:L/VA:L), but the description characterizes the flaw purely as reading/accessing files hosted on the server (CWE-35, absolute path traversal), which is a confidentiality-only behavior - the I/A impacts are not substantiated by the description and should be confirmed with OpenText. Net: a real but low-to-moderate issue, patch in normal cycle rather than emergency. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker crafts a request containing an absolute file path and induces a user to act on it (UI:P), causing the Flipper application to return the contents of an arbitrary server-side file outside the intended directory. No public exploit code is referenced, and the disclosed data is limited to file contents the web process can read. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Information disclosure in OpenText Flipper 3.1.2 allows unauthenticated remote attackers to use absolute path traversal to read files accessible to the Flipper service account, though exploitation requires passive user interaction and is therefore not fully automated. The assessment is moderate severity, with low confidentiality impact (CVSS:3.1 5.3, AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N); no public exploit was identified and EPSS is only 0.39% (31st percentile), so this is not a top-tier priority. Only version 3.1.2 is listed as affected.
RemediationAI
Apply the update or mitigation specified in OpenText advisory KB0850527 (https://support.opentext.com/csm?id=ot_kb_unauthenticated&sysparm_article=KB0850527); the provided data does not include an exact fixed version, so confirm the vendor-recommended patch level rather than assuming 3.1.2 remains safe. Until patched, restrict network access to the Flipper web interface to trusted management networks or VPN, which removes the AV:N vector but may impede distributed users. Run the Flipper service under a least-privilege account so that any successful traversal exposes only files that account can read; this is a compensating control, not a fix, and may break functionality if the service needs broad file access. Add WAF or reverse-proxy rules to block requests containing absolute paths or encoded traversal sequences, but expect potential bypasses. Because UI:R/UI:P is required, user awareness and caution with unsolicited links that trigger Flipper operations can reduce exposure, though it is not a reliable primary mitigation.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected product is OpenText Flipper, identified by CPE cpe:2.3:a:opentext:flipper:3.1.2:*:*:*:*:*:*:*, an OpenText application exposing a web interface. The flaw maps to CWE-35 (path traversal, including absolute path traversal), meaning the application does not properly neutralize user-controlled input used to build filesystem paths, so an attacker can supply an absolute path and cause the server to return files from the local filesystem. The independent assessment assigns CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N, which means the web interface must be network-reachable, no authentication is required (PR:N), but a victim must interact with the crafted request (UI:R); impact is limited to low confidentiality loss with no integrity or availability effect. The original CVSS 4.0 vector similarly shows PR:N and UI:P, and the vendor describes access to files hosted on the server; the practical effect is information disclosure bounded by the file permissions of the Flipper service account.
Know when Flipper gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/S:P/AU:Y/R:U/V:D/RE:M/U:Green
Unauthenticated network path traversal (PR:N, AV:N, AC:L) requiring user interaction (UI:R); description supports read-only file disclosure, so C:L with I:N/A:N.
Primary rating from Vendor (opentext).
CVSS VectorVendor: opentext
DescriptionCVE.org
Path Traversal vulnerability in opentext Flipper allows Absolute Path Traversal.
The vulnerability could allow a user to access files hosted on the server.
This issue affects Flipper: 3.1.2.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Affected Products (CPE)CVE.org
Path traversal in OpenText Flipper 3.1.2 lets an unauthenticated remote actor supply an externally controlled file name
Path traversal in OpenText Flipper 3.1.2 lets an application user submit a stored local file path through the product's
Low-privilege users of OpenText Flipper 3.1.2 can elevate privileges within the application due to insufficient granular
Authenticated low-privilege users of OpenText Flipper 3.1.2 can inject Hibernate Query Language (HQL) expressions into t
Low-privilege users of OpenText Flipper 3.1.2 can bypass intended access controls to interact with the backend API witho
GitHub PoC
Exploit-DB