QwikSec

Security Database

CVE

CWE

Training

CVE-2026-42785

Published: May 26, 2026

Modified: May 26, 2026

PUBLISHED

CVSS v3.1

7.2

HIGH

Description

OpenKM 6.3.12 contains a remote code execution vulnerability that allows authenticated administrators to execute arbitrary Java/BeanShell code through the /admin/Scripting endpoint. Attackers can submit malicious script content with an action=Evaluate parameter to execute operating system commands in the context of the OpenKM application server.

Vendor	Product	Versions
Openkm	OpenKM Community Edition	affected `0 - <= 6.3.12`
Openkm	OpenKM Professional Edition	affected `0 - <= 7.1.47`

Weaknesses (CWE)

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

References

ExploitDB-52520

exploit

Official Product Homepage

product

Product Reference

product

Vulnerability Advisory

vendor-advisory

Proof-of-Concept Toolkit

product

Nuclei Detection Template

product

VulnCheck Advisory: OpenKM 6.3.12 Remote Code Execution via Administrative Scripting

third-party-advisory

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.