CVE-2025-3271VulnerabilityPublished 09/09/2026

CVE-2025-3271: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') in OpenText™ Documentum Webtop

Affects OpenText™ Documentum WebtopSource CVE Database V5

CVSS 4.0 base score

4.8Medium

Exploitation: Not in CISA KEV, no exploitation reported
EPSS: 0.2% chance of exploitation in 30 days – higher than 13% of CVEs

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

What to do

AI-suggested

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should apply standard XSS mitigations such as input validation and output encoding where possible, and limit user privileges. Monitor OpenText communications for updates regarding patches or official mitigations.

Affected software

Product	Affected	Fixed in
OpenText™Documentum Webtop	Affected >=0 <16.7.1	Fixed in 16.7.1

Description

Documentum Webtop versions prior to 16.7.1 software is vulnerable to an XSS

Summary

This vulnerability (CVE-2025-3271) affects OpenText Documentum Webtop prior to version 16.7.1 and is classified as CWE-79, indicating improper neutralization of input leading to cross-site scripting (XSS). The CVSS 4.0 base score is 4.8 (medium), with network attack vector, low attack complexity, requiring low privileges and user interaction, and low impact on confidentiality and integrity. The vulnerability allows injection of malicious scripts during web page generation, potentially impacting users who interact with the affected web application. No vendor advisory or patch information is currently available.

Impact

The vulnerability could allow an attacker with low privileges to execute malicious scripts in the context of a user's browser, potentially leading to session hijacking, information disclosure, or other client-side impacts. However, the impact is rated medium due to the requirement for user interaction and limited scope of confidentiality and integrity impact. There are no known active exploits reported.

Weaknesses

CWE-79Cross-Site Scripting (XSS) (opens in a new tab)

References

support.opentext.com/csm?id=ot_kb_unauthenticated&sysparm_article=KB0869472 (opens in a new tab)

What to do

Affected software

Description

AnalysisAI-generated, updated 09/09/2026, 09:52:46 UTC

Technical details

Weaknesses

References

Related threats