CVE-2026-112181
Multiple Vulnerabilities in OpenKM Community Edition
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Vulnerability due to inadequate restriction of references to external XML entities in OpenKM Community Edition. The XML processing in FormUtils / LocalEntityResolver does not properly restrict the resolution of external resources. An authenticated remote attacker with the ROLE_USER role can exploit the flaw via a REST request. In the 6.3.x branch, this allows the attacker to trigger HTTP requests under their control (SSRF); in 7.0.3, it allows the attacker to read local files and access internal HTTP resources from the server.
| CWE | CWE-611 |
| Vendor | openkm |
| Product | openkm community edition |
| Published | Nov 13, 2026 |
| Last Updated | Nov 13, 2026 |
Stay Ahead of the Next One
Get instant alerts for openkm openkm community edition
Be the first to know when new unknown vulnerabilities affecting openkm openkm community edition are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
OpenKM / OpenKM Community Edition
6.3.3 ≤ 6.3.13 7.0.3
References
Credits
Carlos Alejandro Smith Tay (Las3rs)