OpenKM Vulnerabilities and Affected Products
Vulnerabilities associated with OpenKM Professional Edition.
Products
Clear product- OpenKM3 vulnerabilities
- OpenKM Community Edition3 vulnerabilities
- OpenKM Professional Edition3 vulnerabilities
- Document Management Community1 vulnerability
- OpenKM Document Management Community1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2026-42785HIGH | OpenKM 6.3.12 Remote Code Execution via Administrative ScriptingOpenKM 6.3.12 contains a remote code execution vulnerability that allows authenticated administrators to execute arbitrary Java/BeanShell code through the /admin/Scripting endpoint. Attackers can submit malicious script content with an action=Evaluate parameter to execute operating system commands in the context of the OpenKM application server. CWE-94May 26, 2026 | CVSS8.6v4.0 | EPSS0.679% | PoCs1 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-42425HIGH | OpenKM 6.3.12 Unrestricted SQL Execution via DatabaseQueryOpenKM 6.3.12 contains an unrestricted SQL execution vulnerability that allows authenticated administrative users to execute arbitrary SQL statements against the application database via the DatabaseQuery interface. Attackers can submit malicious SQL queries through the qs parameter to the /admin/DatabaseQuery endpoint to extract sensitive data including usernames and password hashes from the OKM_USER table, modify permissions, or delete database records. CWE-89May 26, 2026 | CVSS8.6v4.0 | EPSS0.641% | PoCs1 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-41917MEDIUM | OpenKM 6.3.12 Local File Inclusion via Admin ScriptingOpenKM 6.3.12 contains a local file inclusion vulnerability in the administrative scripting interface at /admin/Scripting that allows authenticated administrators to read arbitrary files by supplying an attacker-controlled filesystem path through the fsPath parameter with action=Load. Attackers can exploit this to access sensitive files including /etc/passwd, configuration files containing database credentials, and JVM keystores accessible to the OpenKM process. CWE-22May 26, 2026 | CVSS6.9v4.0 | EPSS0.387% | PoCs1 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |