CVE-2023-50072: Openkm

Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days.

A Stored Cross-Site Scripting (XSS) vulnerability exists in OpenKM version 7.1.40 (dbb6e88) With Professional Extension that allows an authenticated user to upload a note on a file which acts as a stored XSS payload. Any user who opens the note of a document file will trigger the XSS.

Affected products

• Openkm Openkm: version 7.1.40 only

Published 2024-01-13. Last modified 2026-06-17.