PatchSiren cyber security CVE debrief
CVE-2026-41917 Openkm CVE debrief
OpenKM 6.3.12 contains a local file inclusion (LFI) vulnerability in the administrative scripting interface at /admin/Scripting. The vulnerability allows authenticated administrators to read arbitrary files by supplying an attacker-controlled filesystem path through the fsPath parameter with action=Load. This can be exploited to access sensitive files including /etc/passwd, configuration files containing database credentials, and JVM keystores accessible to the OpenKM process. The vulnerability was disclosed by Terra System Labs and published to NVD on 2026-05-26. The CVSS 4.0 vector indicates network attack vector with low attack complexity, high privileges required, and high confidentiality impact. No known exploitation in the wild or ransomware campaign use has been reported.
- Vendor
- Openkm
- Product
- OpenKM Community Edition
- CVSS
- MEDIUM 6.9
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-26
- Original CVE updated
- 2026-05-26
- Advisory published
- 2026-05-26
- Advisory updated
- 2026-05-26
Who should care
Organizations running OpenKM 6.3.12 with exposed administrative interfaces; security teams responsible for document management system security; administrators of OpenKM Community Edition deployments
Technical summary
The vulnerability exists in OpenKM 6.3.12's administrative scripting interface at /admin/Scripting. The fsPath parameter with action=Load does not properly validate or sanitize user-supplied filesystem paths, allowing authenticated administrators to read arbitrary files accessible to the OpenKM process. This includes system files (/etc/passwd), application configuration files containing database credentials, and JVM keystores. The attack requires high privileges (administrator authentication) but can result in high confidentiality impact through credential theft and system reconnaissance.
Defensive priority
medium
Recommended defensive actions
- Restrict administrative interface /admin/Scripting access to trusted source IP addresses only
- Implement network segmentation to limit exposure of OpenKM administrative interfaces
- Monitor for anomalous file access patterns from the OpenKM process
- Review and rotate database credentials and JVM keystore passwords if compromise is suspected
- Apply vendor patches when available; consider upgrading to a fixed version
- Enable comprehensive logging on the /admin/Scripting endpoint for forensic analysis
Evidence notes
Vulnerability disclosed by Terra System Labs via VulnCheck advisory. Multiple reference sources confirm the LFI vector in OpenKM 6.3.12 administrative scripting interface. CVSS 4.0 vector provided in NVD record. No CPE criteria available in source data.
Official resources
2026-05-26T15:16:36.440Z