CVE-2025-8054

High

Published: 19 February 2026

Published

19 February 2026

Modified

27 February 2026

KEV Added

—

Patch

—

CVSS Score 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS Score 0.0007 20.8th percentile

Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-8054 is a high-severity Path Traversal (CWE-22) vulnerability in Opentext Xm Fax. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 20.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique.

Threat & Defense Details

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

SI-10 Information Input Validation

addresses: CWE-22

Validates pathnames and filenames to prevent traversal outside intended directories.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1005 Data from Local System Collection

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.

attack.mitre.org →

Why these techniques?

Path traversal in public-facing XM Fax service directly enables remote unauthenticated exploitation (T1190) and arbitrary local file reads (T1005).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in OpenText™ XM Fax allows Path Traversal. The vulnerability could allow an attacker to arbitrarily disclose content of files on the local filesystem. This issue affects XM Fax:…

24.2.

Deeper analysisAI

CVE-2025-8054 is an Improper Limitation of a Pathname to a Restricted Directory vulnerability, classified under CWE-22 (Path Traversal), affecting OpenText™ XM Fax version 24.2. The flaw enables path traversal attacks that bypass restrictions on file access, allowing arbitrary disclosure of content from files on the local filesystem. It carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating high confidentiality impact with no requirements for authentication, privileges, or user interaction.

Attackers can exploit this vulnerability remotely over the network with low complexity and no privileges needed. An unauthenticated adversary could craft malicious requests to traverse directories and read sensitive files accessible to the XM Fax process, potentially exposing configuration data, user information, or other local system files. The unchanged scope limits impact to confidentiality, with no integrity or availability disruption.

OpenText has published a knowledge base article at https://support.opentext.com/csm?id=ot_kb_unauthenticated&sysparm_article=KB0847038 addressing this issue, which security practitioners should consult for detailed mitigation guidance and any available patches.