CVE-2025-8048 External Control of File path vulnerability has been discovered on Openext Flipper.

Medium 5.3 Published 20 Oct 2025 Updated 20 Oct 2025

An attacker can exploit a path traversal flaw in OpenText Flipper to download arbitrary files from the system by manipulating stored document IDs.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2025-8048?

CVE-2025-8048 is a medium-severity path traversal vulnerability in opentext Flipper, published on 20 Oct 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

External Control of File Name or Path vulnerability in opentext Flipper allows Path Traversal. The vulnerability could allow a user to submit a stored local file path and then download the specified file from the system by requesting the stored document ID.

This issue affects Flipper: 3.1.2.

Weakness: CWE-73

Which versions are affected by CVE-2025-8048?

It affects 1 product.

Products include Opentext Flipper.

How do I fix CVE-2025-8048?

No fix has been published for CVE-2025-8048 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2025-8048 being exploited?

There is no known exploitation of CVE-2025-8048 in the wild and no public exploit code.

Sources

Also known as GHSA-77vp-2488-vmf6.