CVE-2026-112181: Multiple Vulnerabilities in OpenKM Community Edition
Vulnerability due to inadequate restriction of references to external XML entities in OpenKM Community Edition. The XML processing in FormUtils / LocalEntityResolver does not properly restrict the resolution of external resources. An authenticated remote attacker with the ROLEUSER role can exploit the flaw via a REST request. In the 6.3.x branch, this allows the attacker to trigger HTTP requests under their control (SSRF); in 7.0.3, it allows the attacker to read local files and access internal HTTP resources from the server.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.3.14 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 7.0.4 - Configuration
Enable FEATURE_SECURE_PROCESSING to disable general and parameter external entities.
OpenKM Community Edition XML processing FEATURE_SECURE_PROCESSING = enabled
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated remote attacker with the ROLE_USER role can exploit it through a REST request. Unauthenticated users are not described as able to exploit the flaw.
What can an attacker do on affected versions?
In the 6.3.x branch, an attacker can cause server-side HTTP requests under their control. In version 7.0.3, an attacker can read local files and access internal HTTP resources from the server.