CVE-2026-41917: Openkm Community Edition

Medium severity, CVSS 4.9. EPSS: 0.6% chance of exploitation in the next 30 days.

OpenKM 6.3.12 contains a local file inclusion vulnerability in the administrative scripting interface at /admin/Scripting that allows authenticated administrators to read arbitrary files by supplying an attacker-controlled filesystem path through the fsPath parameter with action=Load. Attackers can exploit this to access sensitive files including /etc/passwd, configuration files containing database credentials, and JVM keystores accessible to the OpenKM process.

Affected products

• Openkm Openkm Community Edition: up to and including 6.3.12
• Openkm Openkm Professional Edition: up to and including 7.1.47

Published 2026-05-26. Last modified 2026-10-06.