PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-38429 Alkacon CVE debrief

OpenCMS v20 and before is vulnerable to XML External Entity (XXE) in the Admin Import DB feature. This issue arises from insecure XML parsing of user-supplied .zip files containing a manifest.xml. The vulnerability has been assigned a CVSS score of 9.8, indicating critical severity. Affected product deployments should be reviewed for exposure, and owners should be assigned for follow-up. The vulnerability allows for various malicious outcomes, including reading local files, executing system commands, and potentially leading to a full system compromise. Given the critical severity and the potential for XXE attacks to lead to significant impacts such as data breaches or system compromise, immediate attention is advised. Review and update OpenCMS to the latest version if available, and implement compensating controls such as web application firewalls (WAFs) to detect and prevent XXE attacks.

Vendor
Alkacon
Product
OpenCMS
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-05
Original CVE updated
2026-07-24
Advisory published
2026-05-05
Advisory updated
2026-07-24

Who should care

Users of OpenCMS v20 and before should be aware of this vulnerability, especially those who use the Admin Import DB feature. Given the critical severity and the potential for XXE attacks to lead to significant impacts such as data breaches or system compromise, immediate attention is advised.

Technical summary

The vulnerability exists in the Admin Import DB feature of OpenCMS v20 and before. It is caused by the insecure parsing of XML within user-supplied .zip files, specifically the manifest.xml file. This insecure parsing allows for XML External Entity (XXE) attacks, which can lead to various malicious outcomes including but not limited to, reading local files, executing system commands, and potentially leading to a full system compromise.

Defensive priority

High

Recommended defensive actions

  • Review and update OpenCMS to the latest version if available.
  • Implement compensating controls such as web application firewalls (WAFs) to detect and prevent XXE attacks.
  • Restrict access to the Admin Import DB feature to only necessary personnel.
  • Monitor for suspicious activities, especially those related to .zip file uploads and XML parsing.
  • Consider using XML parsers that are not vulnerable to XXE attacks.

Evidence notes

The CVE record was published on 2026-05-05T17:17:04.547Z and was last modified on 2026-07-24T21:10:00.143Z. The NVD entry is currently Deferred. Evidence is based on the CVE record and NVD details provided.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-05-05T17:17:04.547Z and has not been modified since then. The NVD entry is currently Deferred.