OpenKM vulnerabilities
We track 5 vulnerabilities in OpenKM products across 4 products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on November 13, 2026.
Latest OpenKM vulnerabilities
- 8.7 High severity
OpenKM Community Edition: Missing Authorization
Unauthorization vulnerability in the management of workflow definitions in OpenKM Community Edition. The REST endpoints `registerProcessDefinition` and `runProcessDefinition` require authentication but do not verify roles in the WorkflowService or in lower lay
- 8.3 High severity
OpenKM Community Edition: Improper Restriction of XML External Entity Reference
Vulnerability due to inadequate restriction of references to external XML entities in OpenKM Community Edition. The XML processing in FormUtils / LocalEntityResolver does not properly restrict the resolution of external resources. An authenticated remote attac
- 7.2 High severity
OpenKM Community Edition: Improper Control of Generation of Code
OpenKM 6.3.12 contains a remote code execution vulnerability that allows authenticated administrators to execute arbitrary Java/BeanShell code through the /admin/Scripting endpoint. Attackers can submit malicious script content with an action=Evaluate paramete
- 7.2 High severity
OpenKM Community Edition: Improper Neutralization of Special Elements used in an SQL Command
OpenKM 6.3.12 contains an unrestricted SQL execution vulnerability that allows authenticated administrative users to execute arbitrary SQL statements against the application database via the DatabaseQuery interface. Attackers can submit malicious SQL queries t
- 9.8 Critical severity
OpenKM Document Management Community: Improper Restriction of XML External Entity Reference
OpenKM Community Edition in its 6.3.10 version and before was using XMLReader parser in XMLTextExtractor.java file without the required security flags, allowing an attacker to perform a XML external entity injection attack.