Mitigation Strategies

Immediate mitigation steps include restricting access to the administrative scripting interface to trusted administrators only.

Change default or weak administrative credentials to strong, unique passwords to prevent unauthorized access.

Disable or restrict the use of the /admin/Scripting interface if it is not required for daily operations.

Monitor and audit administrative access logs for suspicious activity.

Apply any available patches or updates from the vendor once released; currently, no official patch is available.

Implement network-level controls such as firewall rules to limit access to the OpenKM administrative interface.

Use compensating controls such as multi-factor authentication for administrative accounts.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-41917 is a local file inclusion vulnerability found in OpenKM version 6.3.12 and related Professional Editions. It exists in the administrative scripting interface at the /admin/Scripting endpoint. Authenticated administrators can exploit this flaw by manipulating the fsPath parameter with the action=Load command to read arbitrary files on the server.

This vulnerability allows attackers to access sensitive files such as /etc/passwd, configuration files containing database credentials, and JVM keystores accessible to the OpenKM process. Exploitation requires administrative authentication but can lead to significant information disclosure.

Useful 0 Not Useful 0

Impact Analysis

Exploiting this vulnerability can lead to unauthorized disclosure of sensitive information stored on the OpenKM server. Attackers can read critical system files, configuration files with database credentials, and keystores, potentially enabling further attacks such as privilege escalation or full system compromise.

Since the vulnerability requires administrative authentication, attackers who gain or guess admin credentials (default credentials are known) can leverage this flaw to extract sensitive data and possibly chain it with other vulnerabilities like Remote Code Execution or SQL Injection to take over the system.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by verifying if the administrative scripting interface at /admin/Scripting is accessible and if the fsPath parameter with action=Load can be manipulated to read arbitrary files.

Proof-of-concept exploits and detection templates, including Nuclei templates, are available to automate detection.

A Python-based proof-of-concept tool exists that can be used to validate the vulnerability by attempting to read sensitive files such as /etc/passwd.

Since the exploit requires authentication, testing can be done using default or known administrative credentials (default: okmAdmin:admin).

• Use curl or similar tools to send authenticated requests to the endpoint, for example:
• curl -u okmAdmin:admin 'http://<target>/admin/Scripting?action=Load&fsPath=/etc/passwd'
• Use the provided Python proof-of-concept tool from the exploit repository to automate detection.
• Use Nuclei scanner with the available detection templates from the GitHub repository to scan for this vulnerability.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability in OpenKM 6.3.12 allows authenticated administrators to read arbitrary sensitive files, including configuration files containing database credentials and JVM keystores. This unauthorized access to sensitive data can lead to data breaches and exposure of confidential information.

Such exposure of sensitive information can negatively impact compliance with common standards and regulations like GDPR and HIPAA, which require strict controls over access to personal and sensitive data, as well as protection against unauthorized disclosure.

Because the vulnerability enables attackers to access sensitive files and potentially escalate privileges, organizations using affected OpenKM versions may face increased risk of non-compliance, data breaches, and associated legal or regulatory consequences.

Useful 0 Not Useful 0