OpenText Opentext Directory Services contains an HTML injection flaw in its Swagger UI component. The vulnerability permits the injection of arbitrary HTML and JavaScript into the web interface, which could enable cross‑site scripting attacks or malicious document manipulation. The weakness is classified as CWE‑79, indicating that the input is not properly escaped before rendering.

All releases of OpenText Opentext Directory Services up through version 22.2 are affected across all deployment environments. The issue resides in the OpenText OTDS swagger-ui page and impacts every instance that publishes the exposed Swagger UI endpoint.

The CVSS score of 7.3 classifies this vulnerability as high severity. EPSS information is currently unavailable, and the vulnerability is not listed in CISA KEV, implying no confirmed exploitation yet. The Swagger UI is typically exposed over HTTP(S) and can be accessed by any network host that reaches the OTDS web interface; this suggests a remote attack vector (the likely attack vector is an unauthenticated or minimally privileged web request to the Swagger UI endpoint). Based on the description, it is inferred that an attacker may not need explicit login credentials, though the exact authentication requirements remain unclear.