Multiple Vulnerabilities in OpenKM Community Edition
Severity and exploitation
KEV coverage does not rule out exploitation.
Assessment vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:NSeverity
high8.3CVSS measures technical severity, not the likelihood of an attack.
Known exploitation
Not listed in the checked CISA KEV catalog
Absence from CISA KEV does not rule out attacks.
Public exploit
Not established by this record
Missing evidence does not mean no public exploit exists.
Remediation
Source guidance available
Review the recorded instructions. Guidance may be a workaround rather than a fixed version.
What this means
OpenKM Community Edition versions 6.3.3 to 6.3.13 and 7.0.3 have a vulnerability due to inadequate restriction of external XML entities, allowing an authenticated attacker to trigger HTTP requests or read local files. The attacker must have the ROLE_USER role and send a REST request.
Summarized by @cf/meta/llama-3.3-70b-instruct-fp8-fast. Verify details against the original sources.Attack conditions
No attack-condition excerpt has been identified here. Review the full source description and references for authentication, network access, and configuration requirements.
Review supporting sources →Affected versions
Check the exact model, release, and any platform requirements against your installation.
OpenKM · INCIBE
OpenKM Community Edition
2 ranges
OpenKM · INCIBE
OpenKM Community Edition
Compare with this publisher’s ranges. This does not inspect your installation.
affected
6.3.3 → through 6.3.13
custom versions
7.0.3
Other versions: unaffected
What to do
Compare your installed product and version with the affected versions above. A matching product name alone does not confirm exposure.
Update OpenKM CE 7.0.3 to 7.0.4, which has already been released. According to the manufacturer, the entity resolver has been fixed, and general and parameter external entities have been disabled by enabling FEATURE_SECURE_PROCESSING. For versions 6.3.3 through 6.3.13, the fix will be included in 6.3.14, which is pending release; HTTP requests for non-local DTDs have also been removed.
As a temporary measure to restrict access to the workflow, the vendor recommends blocking non-administrator users from accessing /OpenKM/services/rest/workflow/* and /OpenKM/services/OKMWorkflow on the reverse proxy or firewall. If the web services are not in use, block the entire /OpenKM/services/* directory.
The manufacturer recommends migrating to OpenKM CE 7.0.4. Before migrating from 6.3.x, please note that 7.x does not include the jBPM workflow engine.
cve.new guidance unless attributed to a publisher. This page does not inspect your installation.
Public exploit evidence
No public exploit reference is identified in the imported evidence. This is not a claim that no exploit exists.
Original source description
Read the full publisher description
Vulnerability due to inadequate restriction of references to external XML entities in OpenKM Community Edition. The XML processing in FormUtils / LocalEntityResolver does not properly restrict the resolution of external resources. An authenticated remote attacker with the ROLE_USER role can exploit the flaw via a REST request. In the 6.3.x branch, this allows the attacker to trigger HTTP requests under their control (SSRF); in 7.0.3, it allows the attacker to read local files and access internal HTTP resources from the server.
References
1 sourcesInside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2026-112181View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Underlying weaknesses
The source’s classification of what caused the vulnerability.
Environment requirements
These conditions apply together as specified by the publisher. A matching product name alone does not establish exposure.
INCIBE · platform conditions
Any condition may hold
Any condition may hold
Vulnerable product
cpe:2.3:a:openkm:openkm_community_edition:*:*:*:*:*:*:*:*From (inclusive): 6.3.3
Through (inclusive): 6.3.13
Vulnerable product
cpe:2.3:a:openkm:openkm_community_edition:7.0.3:*:*:*:*:*:*:*Applicability preview
[
{
"operator": "OR",
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:openkm:openkm_community_edition:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.3.3",
"versionEndIncluding": "6.3.13"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:openkm:openkm_community_edition:7.0.3:*:*:*:*:*:*:*"
}
]
}
]
}
]Contributing organizations · 1
Assigning organization
Timeline
All times UTCAdvisory published
Publication date supplied by the source.
Source updated
Latest modification date supplied by the source.
Last imported by cve.new
Latest catalog import, not the date we first saw this advisory.
What changed
Follow changesLarge field values are marked as truncated previews. Original source snapshots remain retained.