CVE-2025-8054
Published: 19 February 2026
Summary
CVE-2025-8054 is a high-severity Path Traversal (CWE-22) vulnerability in Opentext Xm Fax. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 21.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-8054 is an Improper Limitation of a Pathname to a Restricted Directory vulnerability, classified under CWE-22 (Path Traversal), affecting OpenText™ XM Fax version 24.2. The flaw enables path traversal attacks that bypass restrictions on file access, allowing arbitrary disclosure of content from files on the local filesystem. It carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating high confidentiality impact with no requirements for authentication, privileges, or user interaction.
Attackers can exploit this vulnerability remotely over the network with low complexity and no privileges needed. An unauthenticated adversary could craft malicious requests to traverse directories and read sensitive files accessible to the XM Fax process, potentially exposing configuration data, user information, or other local system files. The unchanged scope limits impact to confidentiality, with no integrity or availability disruption.
OpenText has published a knowledge base article at https://support.opentext.com/csm?id=ot_kb_unauthenticated&sysparm_article=KB0847038 addressing this issue, which security practitioners should consult for detailed mitigation guidance and any available patches.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-207641
Vulnerability details
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in OpenText™ XM Fax allows Path Traversal. The vulnerability could allow an attacker to arbitrarily disclose content of files on the local filesystem. This issue affects XM Fax:…
more
24.2.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Path traversal in public-facing XM Fax service directly enables remote unauthenticated exploitation (T1190) and arbitrary local file reads (T1005).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates path traversal by requiring validation of pathname inputs to block traversal sequences and restrict file access to intended directories.
Remediates the specific path traversal flaw in XM Fax 24.2 through timely identification, reporting, and patching as provided by OpenText.
Enforces logical access controls on system resources, limiting the XM Fax application's ability to disclose arbitrary local filesystem files outside restricted paths.