---
id: "CVE-2025-10248"
page: "https://infrastack.ai/live/CVE-2025-10248"
kind: "vulnerability"
aliases: ["CVE-2025-10248"]
title: "OpenText Filr Appliance: stored XSS via uploaded file, up to 25.1.2"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Filr Appliance", "fixed": ["25.4"], "affected": "<= 25.1.2", "ecosystem": "vendor"}]
ecosystems: []
tags: ["file-sharing", "infrastructure", "opentext-filr", "self-hosted"]
not_affected_if: ["filr-25.4-or-later", "filr-newer-than-25.1.2", "no-upload-users"]
published_at: "2026-11-09T16:17:23+00:00"
first_seen_at: "2026-11-09T16:27:26+00:00"
updated_at: "2026-11-09T16:29:59+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-10248", "first_seen_at": "2026-11-09T16:27:26+00:00"}, {"source": "analyst", "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2025-10248", "first_seen_at": "2026-11-09T16:29:59+00:00", "cites": ["https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2025-10248", "https://my.opentext.com/support/article/11802664"]}]
exploit_sources: []
---

# OpenText Filr Appliance: stored XSS via uploaded file, up to 25.1.2

Link for people: https://infrastack.ai/live/CVE-2025-10248 (this .md is for agents)

OpenText Filr Appliance versions up to 25.1.2 let a logged-in user upload a malicious file that stores script code. When another user opens it, the script runs in their browser.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Filr Appliance affected <= 25.1.2 fixed 25.4

## How to check

Check the Filr Appliance version in the admin console; versions 25.1.2 and earlier are affected, 25.4 is listed as unaffected.

## Fix

Upgrade Filr to 25.4 (per CVE record; vendor article not read to confirm)

## Timeline

- 2026-11-09T16:27:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2025-10248
- 2026-11-09T16:29:59+00:00 analyst https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2025-10248 — NVD/CNA record (OpenText): Filr affected <=25.1.2, 25.4 unaffected. Vendor article my.opentext.com/support/article/11802664 is JS/login-only, unreadable (web-cli out of Exa credits), so nothing marked verified. No exploitation or PoC found; social search not done.

## Documents

- [describes] NVD record CVE-2025-10248 (CNA data from OpenText) https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2025-10248
- [mentions] OpenText support article 11802664 (JS-only, login; not readable) https://my.opentext.com/support/article/11802664

## From the sources

XSS Vulnerability in OpenText Filr Appliance versions upto 25.1.2 could allow an authenticated user to upload a malicious file and exercise Stored XSS attack.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_