CVE-2026-41917: OpenKM 6.3.12 Local File Inclusion via Admin Scripting
OpenKM 6.3.12 contains a local file inclusion vulnerability in the administrative scripting interface at /admin/Scripting that allows authenticated administrators to read arbitrary files by supplying an attacker-controlled filesystem path through the fsPath parameter with action=Load. Attackers can exploit this to access sensitive files including /etc/passwd, configuration files containing database credentials, and JVM keystores accessible to the OpenKM process.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenKMto a version that resolves this vulnerability.Fixed in 6.3.12 - Configuration
Harden the OpenKM admin scripting endpoint so that action=Load cannot be used to load arbitrary attacker-controlled filesystem paths via the fsPath parameter.
OpenKM administrative scripting interface (/admin/Scripting) action=Load with fsPath parameter = Disallow/disable attacker-controlled fsPath loading - Compensating control
Restrict access to the OpenKM administrative scripting interface (/admin/Scripting) so only trusted administrators can reach it (e.g., via network ACL/firewall allowlisting), since the vulnerability requires authenticated administrators.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41917?
The severity of CVE-2026-41917 is classified as medium with a score of 4.9.
How do I fix CVE-2026-41917?
To fix CVE-2026-41917, apply the latest security patches provided by OpenKM or upgrade to a newer version of the software.
What systems are affected by CVE-2026-41917?
CVE-2026-41917 affects OpenKM version 6.3.12 specifically.
What type of vulnerability is CVE-2026-41917?
CVE-2026-41917 is a local file inclusion vulnerability that involves path traversal.
Who can exploit CVE-2026-41917?
CVE-2026-41917 can be exploited by authenticated administrators who have access to the administrative scripting interface.