An authenticated user can upload a malicious file that contains embedded JavaScript, resulting in a stored cross‑site scripting (XSS) attack against the OpenText Filr Appliance. The injected script executes in the context of any user who views the uploaded content, allowing attackers to hijack sessions, steal credentials, or perform arbitrary actions on behalf of that user.

Versions of the OpenText Filr Appliance up to 25.1.2 are affected. The vulnerability is absent in versions 25.4 and later.

The CVSS score is 7.2, indicating moderate‑to‑high severity. No EPSS score is available, and the flaw is not listed in CISA’s KEV catalog. The exploit requires an authenticated user with upload privileges, a scenario that exists in most deployments – the likely attack vector is an account with write permissions to the file upload interface.