CVE-2026-42425: OpenKM 6.3.12 Unrestricted SQL Execution via DatabaseQuery

Published May 26, 2026

Updated

OpenKM 6.3.12 contains an unrestricted SQL execution vulnerability that allows authenticated administrative users to execute arbitrary SQL statements against the application database via the DatabaseQuery interface. Attackers can submit malicious SQL queries through the qs parameter to the /admin/DatabaseQuery endpoint to extract sensitive data including usernames and password hashes from the OKMUSER table, modify permissions, or delete database records.

Affected Software

1 affected component

OpenKM OpenKM=6.3.12

Event History

May 26, 2026

CVE Published

via MITRE·02:08 PM

Data Sourced

via MITRE·02:08 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2026-42425?

CVE-2026-42425 has a high severity rating of 7.2.

How do I fix CVE-2026-42425?

To mitigate CVE-2026-42425, update OpenKM to the latest version where the vulnerability has been patched.

Who is affected by CVE-2026-42425?

CVE-2026-42425 affects authenticated administrative users of OpenKM 6.3.12.

What type of vulnerability is CVE-2026-42425?

CVE-2026-42425 is classified as an SQL Injection vulnerability.

How does CVE-2026-42425 work?

CVE-2026-42425 allows authenticated users to execute arbitrary SQL statements through the DatabaseQuery interface.