PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-38429 Alkacon CVE debrief

OpenCMS v20 and before is vulnerable to XML External Entity (XXE) in the Admin Import DB feature. This issue arises from insecure XML parsing of user-supplied .zip files containing a manifest.xml. The vulnerability has been assigned a CVSS score of 9.8, indicating critical severity. Affected product deployments should be reviewed for exposure, and owners should be assigned for follow-up. The vulnerability allows for various malicious outcomes, including reading local files, executing system commands, and potentially leading to a full system compromise. Given the critical severity and the potential for XXE attacks to lead to significant impacts such as data breaches or system compromise, immediate attention is advised. Review and update OpenCMS to the latest version if available, and implement compensating controls such as web application firewalls (WAFs) to detect and prevent XXE attacks.

Vendor
Alkacon
Product
OpenCMS
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-05
Original CVE updated
2026-07-24
Advisory published
2026-05-05
Advisory updated
2026-07-24

Who should care

Users of OpenCMS v20 and before should be aware of this vulnerability, especially those who use the Admin Import DB feature. Given the critical severity and the potential for XXE attacks to lead to significant impacts such as data breaches or system compromise, immediate attention is advised.

Technical summary

The vulnerability exists in the Admin Import DB feature of OpenCMS v20 and before. It is caused by the insecure parsing of XML within user-supplied .zip files, specifically the manifest.xml file. This insecure parsing allows for XML External Entity (XXE) attacks, which can lead to various malicious outcomes including but not limited to, reading local files, executing system commands, and potentially leading to a full system compromise.

Defensive priority

High

Recommended defensive actions

  • Review and update OpenCMS to the latest version if available.
  • Implement compensating controls such as web application firewalls (WAFs) to detect and prevent XXE attacks.
  • Restrict access to the Admin Import DB feature to only necessary personnel.
  • Monitor for suspicious activities, especially those related to .zip file uploads and XML parsing.
  • Consider using XML parsers that are not vulnerable to XXE attacks.

Evidence notes

The CVE record was published on 2026-05-05T17:17:04.547Z and was last modified on 2026-07-24T21:10:00.143Z. The NVD entry is currently Deferred. Evidence is based on the CVE record and NVD details provided.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-38429 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-38429

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-38429 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-38429

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.