CVE-2023-42344: Alkacon OpenCms XXE in Chemistry servlet

CVE-2023-42344 · Severity: high · CVSS 7.3 · Published 2026-05-08

Alkacon OpenCms, a popular open-source content management system, contains a security flaw that allows unauthorized individuals to access sensitive files on the server. By sending a specially crafted request to a specific web component, an attacker can read internal system files or configuration data without needing a username or password. This could lead to the exposure of credentials, source code, or other private information, potentially allowing for further compromise of the hosting environment.

Technologies: Alkacon OpenCms, org.opencms:opencms-core (Maven). Vendors: Alkacon, Maven.

Quick answers

Is CVE-2023-42344 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2023-42344 being exploited in the wild.
How severe is CVE-2023-42344?
High severity, with a CVSS score of 7.3, published 8 May 2026.
Which products and versions are affected?
Alkacon OpenCms < 10.5.1; org.opencms:opencms-core (Maven) < 10.5.1, ECOSYSTEM:introduced=0,fixed=10.5.1.
Is there a fix for CVE-2023-42344?
Yes. org.opencms:opencms-core (Maven): upgrade to 10.5.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2023-42344 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2023-42344?
Check whether you run Alkacon OpenCms or org.opencms:opencms-core (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.opencms:opencms-core (Maven): upgrade to 10.5.1 or later
    # set org.opencms:opencms-core to 10.5.1 in your pom.xml or build.gradle

Technical details

An XML External Entity (XXE) vulnerability exists in Alkacon OpenCms versions prior to 10.5.1. The flaw is located within the Apache Chemistry OpenCMIS implementation, specifically the 'cmis-online/query' endpoint handled by the Chemistry servlet. A remote, unauthenticated attacker can exploit this by sending a crafted POST request containing a malicious XML payload to the /cmisatom/ endpoint. Because the XML parser fails to properly restrict external entity references, an attacker can achieve local file inclusion (LFI) to read sensitive files (e.g., /etc/passwd) or perform Out-of-Band (OOB) data exfiltration. The vulnerability is patched in version 10.5.1.

Affected products

  • Alkacon OpenCms < 10.5.1

Identifiers

  • CVE-2023-42344
  • GHSA-rcc6-6q2f-m2cw

Timeline

  • 2023-11-21: disclosed: Initial technical write-up published by watchTowr Labs
  • 2026-05-08: advisory: GitHub Advisory and NVD entry published
  • 2026-05-14: patched: Advisory updated to reflect patched status in 10.5.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.