CVE-2026-41917: OpenKM 6.3.12 Local File Inclusion via Admin Scripting
Advisory generated from the CVE record, CISA, Exploit Observer and VEDAS: what it is, whether it is exploited, who is affected, and how to fix and detect it.
Generated by VEDAS. Scores as of 2026-11-01 19:19 UTC. Rebuilt every few hours from cve-scores, CISA KEV and vedas-signatures. How this works and its limits.
What it is
OpenKM 6.3.12 contains a local file inclusion vulnerability in the administrative scripting interface at /admin/Scripting that allows authenticated administrators to read arbitrary files by supplying an attacker-controlled filesystem path through the fsPath parameter with action=Load. Attackers can exploit this to access sensitive files including /etc/passwd, configuration files containing database credentials, and JVM keystores accessible to the OpenKM process.
Description quoted from the CVE record (assigned by VulnCheck, published 2026-05-26).
Weakness: Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’)
How it can be exploited
Exploitable over the network with low attack complexity with no special attack requirements needing high privileges and no user interaction. Impact: confidentiality high, integrity none, availability none. CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CISA assessment (SSVC): CISA assesses that a public proof of concept exists. Automatable: no. Technical impact: partial.
Public exploit evidence (Exploit Observer)
Also known as: EDB-52520, EUVD-2026-31833, GHSA-hf34-4jm2-f8qq
VEDAS cluster: VEDAS:FREDDYFLAMINGO
Exploit Observer links 4 pieces of public exploit code or detection modules that name this CVE or one of its aliases.
Exploit code and modules (4)
Code that names this CVE. A repository can be a working exploit, a scanner, a fake or malware; read it before running anything.
- Exploit-DB: https://www.exploit-db.com/raw/52520
- Code repository: https://raw.githubusercontent.com/ARPSyndicate/vedas-signatures/main/suricata/2026/CVE-2026-41917.rules
- Code repository: https://raw.githubusercontent.com/ARPSyndicate/vedas-signatures/main/suricata/2026/CVE-2026-41917.rules
- Code repository: https://raw.githubusercontent.com/ARPSyndicate/vedas-signatures/main/suricata/2026/CVE-2026-41917.rules
Vulnerability databases and vendor advisories (3)
Catalogue entries, not exploit evidence.
- Vulnerability database or vendor advisory: https://euvd.enisa.europa.eu/enisa/EUVD-2026-31833
- Vulnerability database or vendor advisory: https://github.com/advisories/GHSA-hf34-4jm2-f8qq
- Vulnerability database or vendor advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-41917
4 more references returned by Exploit Observer did not name this CVE or an alias, so they are left out.
VEDAS data as of 2026-11-01T17:12 UTC; fetched 2026-11-02.
Live scores
- EPSS
- 0.004
low predicted chance of attack - VEDAS
- 0.976
strong exploit evidence - On CISA KEV
- Not listed
- Detection rule
- Suricata
Who is affected
| Product | Affected | Not affected |
|---|---|---|
| Openkm OpenKM Community Edition | up to and including 6.3.12 | Not stated |
| Openkm OpenKM Professional Edition | up to and including 7.1.47 | Not stated |
Version ranges exactly as the CVE record states them. “Before X” means X is the first fixed version.
How to fix it
Vendor guidance:
- Vulnerability Advisory (vendor-advisory)
How to detect it
Suricata rules (network detection)
1 rule that alert on traffic matching this exploit: VEDAS CVE-2026-41917 OpenKM Admin Scripting LFI (fsPath). Add them to your Suricata rule set and reload.
Show the rules
# CVE-2026-41917 - OpenKM 6.3.12 authenticated LFI in the admin scripting interface. The
# /admin/Scripting endpoint with action=Load reads an arbitrary filesystem path supplied in
# the fsPath parameter (e.g. /etc/passwd, config files, JVM keystores). Detect the request
# combining the Scripting endpoint with action=Load and the fsPath parameter.
alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"VEDAS CVE-2026-41917 OpenKM Admin Scripting LFI (fsPath)"; flow:established,to_server; http.uri; content:"/admin/Scripting"; fast_pattern; content:"fsPath="; nocase; content:"action=Load"; nocase; classtype:web-application-attack; reference:cve,CVE-2026-41917; reference:url,https://www.exploit.observer/?keyword=CVE-2026-41917&match=exact; reference:url,https://subdomain.center/?engine=ammonites&keyword=openkm&match=exact; sid:1100005; rev:1;)
CVE-2026-41917.rules on GitHub
References
Vendor advisories and patches
- Vulnerability Advisory (vendor-advisory)
Exploits and technical analysis
- ExploitDB-52520 (exploit)
- VulnCheck Advisory: OpenKM 6.3.12 Local File Inclusion via Admin Scripting (third-party-advisory)
Other references
- Official Product Homepage (product)
- Product Reference (product)
- Proof-of-Concept Toolkit (product)
- Nuclei Detection Template (product)
Other databases
Where this comes from
This advisory is generated automatically by VEDAS from: CVE.org record, cve-scores (EPSS and VEDAS), Exploit Observer, vedas-signatures. Text in quotes is reproduced from the source; everything else is a fixed template filled with source fields. Nothing here is written by a language model. Check the vendor advisory before acting, and read how VEDAS and Exploit Observer work, and their limits.