CVE-2026-41917

MEDIUM

OpenKM 6.3.12 Local File Inclusion via Admin Scripting

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2026-41917 has a selected CVSS score of 6.9 (medium); EIP currently links 1 catalogued exploit.

Description

OpenKM 6.3.12 contains a local file inclusion vulnerability in the administrative scripting interface at /admin/Scripting that allows authenticated administrators to read arbitrary files by supplying an attacker-controlled filesystem path through the fsPath parameter with action=Load. Attackers can exploit this to access sensitive files including /etc/passwd, configuration files containing database credentials, and JVM keystores accessible to the OpenKM process.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated May 27, 2026 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

OpenKM Community Edition

Browse Openkm / OpenKM Community Edition

Default status: unknown

CVE ListThrough 6.3.12affected

OpenKM Professional Edition

Browse Openkm / OpenKM Professional Edition

Default status: unknown

CVE ListThrough 7.1.47affected

Proofs of concept

1

Catalogued exploits

ExploitDBOpenKM 6.3.12 - MultipleExploitDB exploitby skumarExploit1 file

linked to 3 vulnerabilities

ExploitDB
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python script that exploits multiple vulnerabilities in OpenKM 6.3.12, including authenticated Local File Inclusion (LFI), Remote Code Execution (RCE) via scripting engine, and SQL injection to extract user password hashes, with an optional hash cracking routine.

Backdoor review

No backdoor observed in reviewed code

The reviewed Python script is a proof-of-concept exploit for OpenKM vulnerabilities (LFI, RCE, SQLi). It performs only the advertised exploitation actions against a user-supplied target. No concealed backdoor, unrelated payload, or deceptive operator-directed harm was observed in the supplied text.

ClassificationExploit
Model confidence95%
AuthenticationRequired
Languagespython
Target softwareOpenKM Community Edition 6.3.12OpenKM Pro Edition 7.1.47
Attack typeslocal file inclusionremote code executionsql injectioncredential cracking
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script contains functions that actively exploit vulnerabilities: lfi() reads arbitrary files, rce() executes arbitrary commands, and sqli() extracts database contents. These go beyond detection and perform the exploitation actions.

exploits/multiple/webapps/52520.py:124-154exploits/multiple/webapps/52520.py:157-194exploits/multiple/webapps/52520.py:277-333

Requirements

  • Valid credentials for OpenKM (default okmAdmin:admin used if not provided)exploits/multiple/webapps/52520.py:385-386
  • Target OpenKM instance accessible at a base URLexploits/multiple/webapps/52520.py:361

Observed behavior

  • Authenticates to OpenKM using provided or default credentialsexploits/multiple/webapps/52520.py:105-120
  • Performs Local File Inclusion by loading arbitrary files via the admin Scripting interfaceexploits/multiple/webapps/52520.py:124-154
  • Executes arbitrary operating system commands via Java code evaluated in the admin Scripting interfaceexploits/multiple/webapps/52520.py:157-194
  • Extracts user password hashes via SQL injection on the admin DatabaseQuery page and optionally cracks them with hashcatexploits/multiple/webapps/52520.py:277-333
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
Payload withheldThe script's functions lfi(), rce(), sqli(), and crack_password() implement the advertised vulnerabilities. All actions are directed at the target provided via --url and require explicit user interaction.exploits/multiple/webapps/52520.py:124-154exploits/multiple/webapps/52520.py:157-194exploits/multiple/webapps/52520.py:277-333exploits/multiple/webapps/52520.py:197-272
Library Installation
Payload withheldThe check_and_install_libraries() function installs missing dependencies. This is a convenience feature for the user and does not introduce hidden behavior.exploits/multiple/webapps/52520.py:24-36
External Command Execution
Payload withheldThe crack_password() function runs hashcat on user-supplied wordlists against hashes extracted from the target. This is part of the advertised SQLi + cracking workflow and is not a backdoor.exploits/multiple/webapps/52520.py:268-269
Review boundaries

What the analysis did not establish

  • Evidence is limited to the single Python file; external dependencies (e.g., hashcat, wordlists) and referenced resources are not included.
  • The script's actual effectiveness or safety is not verified; classification is based solely on code intent.
  • Only the single Python file was reviewed; no external resources, libraries, or referenced URLs were fetched or analyzed.
  • Binary files were not inspected (none present in this packet).
  • The review does not assess the safety or correctness of the exploit code itself, only the absence of backdoor behavior.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

8