Executive brief
Alkacon OpenCms, a popular open-source content management system, contains a security flaw that allows unauthorized individuals to access sensitive files on the server. By sending a specially crafted request to a specific web component, an attacker can read internal system files or configuration data without needing a username or password. This could lead to the exposure of credentials, source code, or other private information, potentially allowing for further compromise of the hosting environment.
Technical details
An XML External Entity (XXE) vulnerability exists in Alkacon OpenCms versions prior to 10.5.1. The flaw is located within the Apache Chemistry OpenCMIS implementation, specifically the 'cmis-online/query' endpoint handled by the Chemistry servlet. A remote, unauthenticated attacker can exploit this by sending a crafted POST request containing a malicious XML payload to the /cmisatom/ endpoint. Because the XML parser fails to properly restrict external entity references, an attacker can achieve local file inclusion (LFI) to read sensitive files (e.g., /etc/passwd) or perform Out-of-Band (OOB) data exfiltration. The vulnerability is patched in version 10.5.1.
Affected products
- Alkacon OpenCms < 10.5.1
Timeline
- 2023-11-21: disclosed: Initial technical write-up published by watchTowr Labs
- 2026-05-08: advisory: GitHub Advisory and NVD entry published
- 2026-05-14: patched: Advisory updated to reflect patched status in 10.5.1