CVE-2026-38429

CriticalCVSS 9.8

Published: 05/05/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.30%

22th percentile - higher than 22% of all known CVEs

Summary

OpenCMS version 20 and before is vulnerable to XML External Entity (XXE) in the Admin Import DB feature due to insecure XML parsing of user-supplied .zip files containing a manifest.xml.

Risk Assessment

The organization risks exposure of sensitive server files, server-side request forgery (SSRF), or other XML-related attacks, potentially leading to data confidentiality and integrity breaches.

Recommendation

Update OpenCMS to a version containing the fix for this vulnerability, or apply appropriate XML parsing safeguards.

Original NVD description (English source)

OpenCMS v20 and before is vulnerable to XML External Entity (XXE) in the Admin Import DB feature due to insecure XML parsing of user supplied .zip files containing a manifest.xml.