CVE-2026-42425
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk47th percentile - higher than 47% of all known CVEs
Summary
OpenKM 6.3.12 contains an unrestricted SQL execution vulnerability that allows authenticated administrative users to execute arbitrary SQL statements against the application database via the DatabaseQuery interface. Attackers can submit malicious SQL queries through the qs parameter to the /admin/DatabaseQuery endpoint to extract sensitive data including usernames and password hashes from the OKM_USER table, modify permissions, or delete database records.
Risk Assessment
An administrator can access all data in the database, including user passwords, leading to full compromise of system confidentiality and integrity.
Recommendation
Immediately upgrade OpenKM to the latest version. Also restrict access to the DatabaseQuery interface to trusted administrators and apply the principle of least privilege.
Other vulnerabilities in OpenKM
See all- CVE-2026-42785High
OpenKM version 6.3.12 contains a remote code execution vulnerability that allows authenticated administrators to execute arbitrary Java/BeanShell code through the /admin/Scripting endpoint. Attackers can submit malicious script content with an action=Evaluate parameter to execute operating system commands in the context of the OpenKM application server.
- CVE-2026-41917Medium
OpenKM 6.3.12 has a local file inclusion vulnerability in the administrative scripting interface at /admin/Scripting. An authenticated administrator can read arbitrary files by supplying a filesystem path via the fsPath parameter with action=Load.
Original NVD description (English source)
OpenKM 6.3.12 contains an unrestricted SQL execution vulnerability that allows authenticated administrative users to execute arbitrary SQL statements against the application database via the DatabaseQuery interface. Attackers can submit malicious SQL queries through the qs parameter to the /admin/DatabaseQuery endpoint to extract sensitive data including usernames and password hashes from the OKM_USER table, modify permissions, or delete database records.