PT-2026-20947 · Opentext · Opentext Web Site Management Server

Murat Altindis · Published 2026-02-19 · Updated 2026-02-27 · CVE-2025-9208

Positive Technologies (AI Summary)

CVSS v4.0

7.5

High

Base vector

AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:L/SI:N/SA:N/S:P/AU:N/R:U/V:D/RE:H/U:Red

Name of the Vulnerable Software and Affected Versions OpenText Web Site Management Server versions 16.7.X, 16.8, and 16.8.1

Description A flaw exists in OpenText Web Site Management Server that allows for Stored Cross-site Scripting (XSS). The issue occurs when the download query parameter is removed from a file URL, potentially enabling attackers to execute malicious scripts on the client side. Successful exploitation could lead to compromised user sessions and data. The API endpoint involved is a file URL where the download parameter is processed. The vulnerable parameter is download.

Recommendations Versions 16.7.X should be updated. Versions 16.8 should be updated. Versions 16.8.1 should be updated.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-9208

Affected Products

Opentext Web Site Management Server

References · 7

• 🔥 https://github.com/MarioTesoro/vulnerability-research/blob/main/CVE-2025-9208/README.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-9208 · Security Note
• https://support.opentext.com/csm/en?id=ot_kb_unauthenticated&sysparm_article=KB0854844 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-9208 · Vendor Advisory
• https://t.me/CVEtracker/45195 · Telegram Post
• https://t.me/cveNotify/152538 · Telegram Post
• https://t.me/cveNotify/153602 · Telegram Post