QwikSec

Security Database

CVE

CWE

Training

CVE-2026-41917

Published: May 26, 2026

Modified: May 27, 2026

PUBLISHED

CVSS v3.1

4.9

MEDIUM

Description

OpenKM 6.3.12 contains a local file inclusion vulnerability in the administrative scripting interface at /admin/Scripting that allows authenticated administrators to read arbitrary files by supplying an attacker-controlled filesystem path through the fsPath parameter with action=Load. Attackers can exploit this to access sensitive files including /etc/passwd, configuration files containing database credentials, and JVM keystores accessible to the OpenKM process.

Vendor	Product	Versions
Openkm	OpenKM Community Edition	affected `0 - <= 6.3.12`
Openkm	OpenKM Professional Edition	affected `0 - <= 7.1.47`

Weaknesses (CWE)

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

References

ExploitDB-52520

exploit

Official Product Homepage

product

Product Reference

product

Vulnerability Advisory

vendor-advisory

Proof-of-Concept Toolkit

product

Nuclei Detection Template

product

VulnCheck Advisory: OpenKM 6.3.12 Local File Inclusion via Admin Scripting

third-party-advisory

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.