CVE-2023-4550 is a high severity (CVSS 7.5) arbitrary file read in OpenText AppBuilder, from version 21.2 before 23.2, on Windows and Linux. An unauthenticated or authenticated user can read files on the host server. Upgrade to 23.2 or later and check the OpenText notice.
What's affected
The NVD record says improper input validation, and files or directories accessible to external parties, in OpenText AppBuilder on Windows and Linux allow probing of system files. An unauthenticated or authenticated user can abuse a page of AppBuilder to read arbitrary files on the server that hosts it.
The affected range is AppBuilder from 21.2 before 23.2, so 23.2 is the first release outside the range. The record points to an OpenText support knowledge base article as its only reference. That site needs a browser session and could not be read by automated tools, so check the article for platform specific notes and for any patch that exists for older streams.
The same advisory family includes two more AppBuilder CVEs from the same date, CVE-2023-4551 and CVE-2023-4552. Plan the upgrade once and cover all three.
How to check if you're exposed
Find your AppBuilder version in the product about page or in your installation records. Anything from 21.2 up to, but not including, 23.2 is in scope.
Check who can reach the AppBuilder web interface. The record says no login is needed to reach the vulnerable page, so network exposure decides how much time you have.
Review web logs for requests to unusual pages or with parameters that look like file paths, from addresses that do not belong to your users.
Look at what the AppBuilder service account can read. The impact of a file read is capped by that account permissions.
What to do now
- Inventory AppBuilder servers and versions.
- Upgrade to 23.2 or later, following OpenText guidance for your platform.
- Limit access to the interface to the networks that need it until the upgrade is done.
- Run the service under an account with minimal file system rights.
- Rotate any credentials or keys that are stored in files the service account could read, if you see signs of misuse.
Why it matters
The record lists CWE-20, CWE-552, which cover improper input validation and exposure of files to outside parties. A page accepts a value that points at a file and returns that file without limiting it to a safe location.
File read bugs are often the first step in a larger chain, because configuration files hold database passwords and keys. The record does not claim exploitation and the CVE is not in the CISA KEV catalog. Check that secrets are not kept in files that a web application account can read.
Quick check
Does the attacker need an account?
The record says an unauthenticated or authenticated user can abuse the page. Treat it as reachable by anyone who can reach the web interface.
Sources
Last reviewed: 19 October 2026.
