{"id":"CVE-2025-10248","kind":"vulnerability","aliases":["CVE-2025-10248"],"related":[],"title":"OpenText Filr Appliance: stored XSS via uploaded file, up to 25.1.2","description":"XSS Vulnerability in OpenText Filr Appliance versions upto 25.1.2 could allow an authenticated user to upload a malicious file and exercise Stored XSS attack.","summary":"OpenText Filr Appliance versions up to 25.1.2 let a logged-in user upload a malicious file that stores script code. When another user opens it, the script runs in their browser.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Filr Appliance","fixed":["25.4"],"affected":"<= 25.1.2","ecosystem":"vendor"}],"ecosystems":[],"tags":["file-sharing","infrastructure","opentext-filr","self-hosted"],"not_affected_if":["filr-25.4-or-later","filr-newer-than-25.1.2","no-upload-users"],"how_to_check":"Check the Filr Appliance version in the admin console; versions 25.1.2 and earlier are affected, 25.4 is listed as unaffected.","fix":"Upgrade Filr to 25.4 (per CVE record; vendor article not read to confirm)","status":"open","published_at":"2026-11-09T16:17:23+00:00","first_seen_at":"2026-11-09T16:27:26+00:00","triaged_at":"2026-11-09T16:28:33+00:00","updated_at":"2026-11-09T16:29:59+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-09T16:28:33Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"OpenText Filr Appliance: stored XSS via uploaded file, up to 25.1.2","impact":"medium","summary":"OpenText Filr Appliance versions up to 25.1.2 let a logged-in user upload a malicious file that stores script code. When another user opens it, the script runs in their browser.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["opentext-filr","self-hosted","file-sharing"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker runs scripts in other users' browsers, stealing their sessions","analyst_note":"Find the vendor advisory and the fixed version beyond 25.1.2 at https://nvd.nist.gov/vuln/detail/CVE-2025-10248.","how_to_check":"- Check the installed Filr Appliance version against `25.1.2` in the appliance admin console.\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["filr-newer-than-25.1.2"],"who_is_affected":"Organizations running the OpenText Filr Appliance at or below 25.1.2 where users can upload files. Exposure depends on whether other users open the uploaded files in a browser. The sources do not say which fixed version to move to.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000703,"input_tokens":4523,"output_tokens":501,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the vendor advisory and the fixed version beyond 25.1.2 at https://nvd.nist.gov/vuln/detail/CVE-2025-10248.","search":"'-10248':14A,17A '-2025':13A,16A '25.1.2':11A,36B,70C 'allow':72C 'anoth':52B 'applianc':3A,32B,67C 'appliance':19A 'attack':85C 'authent':74C 'browser':61B 'code':50B 'could':71C 'cve':12A,15A 'exercis':82C 'file':8A,21B,46B,80C 'file-shar':20B 'filr':2A,18A,26B,31B,66C 'host':29B 'infrastructur':23B 'let':37B 'log':40B 'logged-in':39B 'malici':45B,79C 'open':54B 'opentext':1A,25B,30B,65C 'opentext-filr':24B 'run':58B 'script':49B,57B 'self':28B 'self-host':27B 'share':22B 'store':4A,48B,83C 'upload':7A,43B,77C 'upto':69C 'user':42B,53B,75C 'version':33B,68C 'via':6A 'vulner':63C 'xss':5A,62C,84C","nicknames":[],"mitigations":[],"who_affected":"Organizations running a self-hosted OpenText Filr Appliance at 25.1.2 or earlier. An authenticated user with upload rights can store a malicious file whose script runs in another user's browser when opened. Teams on Filr 25.4 or later can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["appliance","filrappliance"],"ptokens":["appliance","filr"],"labels":["filesharing","high","infrastructure","opentextfilr","selfhosted"],"campaign_type":null,"search_a":"'-10248':14A,17A '-2025':13A,16A '25.1.2':11A 'applianc':3A 'appliance':19A 'cve':12A,15A 'file':8A 'filr':2A,18A 'opentext':1A 'store':4A 'upload':7A 'via':6A 'xss':5A","search_b":"'25.1.2':36B 'anoth':52B 'applianc':32B 'browser':61B 'code':50B 'file':21B,46B 'file-shar':20B 'filr':26B,31B 'host':29B 'infrastructur':23B 'let':37B 'log':40B 'logged-in':39B 'malici':45B 'open':54B 'opentext':25B,30B 'opentext-filr':24B 'run':58B 'script':49B,57B 'self':28B 'self-host':27B 'share':22B 'store':48B 'upload':43B 'user':42B,53B 'version':33B","search_c":"'25.1.2':70C 'allow':72C 'applianc':67C 'attack':85C 'authent':74C 'could':71C 'exercis':82C 'file':80C 'filr':66C 'malici':79C 'opentext':65C 'store':83C 'upload':77C 'upto':69C 'user':75C 'version':68C 'vulner':63C 'xss':62C,84C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T16:17:23+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:A/V:D/RE:M/U:X","cvss_by":"security@opentext.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2025-10248","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-10248","severity":null,"published_at":"2026-11-09T16:17:23+00:00","modified_at":"2026-11-09T16:17:23+00:00","first_seen_at":"2026-11-09T16:27:26+00:00","fetched_at":"2026-11-09T16:27:26+00:00","note":null},{"source":"analyst","external_id":"CVE-2025-10248:2301","url":"https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2025-10248","severity":null,"published_at":"2026-11-09T16:29:59+00:00","modified_at":"2026-11-09T16:29:59+00:00","first_seen_at":"2026-11-09T16:29:59+00:00","fetched_at":"2026-11-09T16:29:59+00:00","note":"NVD/CNA record (OpenText): Filr affected <=25.1.2, 25.4 unaffected. Vendor article my.opentext.com/support/article/11802664 is JS/login-only, unreadable (web-cli out of Exa credits), so nothing marked verified. No exploitation or PoC found; social search not done.","cites":["https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2025-10248","https://my.opentext.com/support/article/11802664"]}],"documents":[{"id":108325,"url":"https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2025-10248","title":"NVD record CVE-2025-10248 (CNA data from OpenText)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":108326,"url":"https://my.opentext.com/support/article/11802664","title":"OpenText support article 11802664 (JS-only, login; not readable)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}