# CVE-2023-42344: Alkacon OpenCms XXE in Chemistry servlet

Source: https://junglewise.ai/threats/cve-2023-42344-alkacon-opencms-xxe-in-chemistry-servlet  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-08. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2023-42344 · Severity: high · CVSS 7.3 · Published 2026-05-08

Alkacon OpenCms, a popular open-source content management system, contains a security flaw that allows unauthorized individuals to access sensitive files on the server. By sending a specially crafted request to a specific web component, an attacker can read internal system files or configuration data without needing a username or password. This could lead to the exposure of credentials, source code, or other private information, potentially allowing for further compromise of the hosting environment.

Technologies: [Alkacon OpenCms](https://junglewise.ai/threats/technologies/opencms), [org.opencms:opencms-core (Maven)](https://junglewise.ai/threats/technologies/org-opencms-opencms-core). Vendors: [Alkacon](https://junglewise.ai/threats/vendors/alkacon), [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2023-42344 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2023-42344 being exploited in the wild.

**How severe is CVE-2023-42344?** High severity, with a CVSS score of 7.3, published 8 May 2026.

**Which products and versions are affected?** Alkacon OpenCms < 10.5.1; org.opencms:opencms-core (Maven) < 10.5.1, ECOSYSTEM:introduced=0,fixed=10.5.1.

**Is there a fix for CVE-2023-42344?** Yes. org.opencms:opencms-core (Maven): upgrade to 10.5.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2023-42344 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2023-42344?** Check whether you run Alkacon OpenCms or org.opencms:opencms-core (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.opencms:opencms-core (Maven): upgrade to 10.5.1 or later

  ```sh
  # set org.opencms:opencms-core to 10.5.1 in your pom.xml or build.gradle
  ```


## Technical details

An XML External Entity (XXE) vulnerability exists in Alkacon OpenCms versions prior to 10.5.1. The flaw is located within the Apache Chemistry OpenCMIS implementation, specifically the 'cmis-online/query' endpoint handled by the Chemistry servlet. A remote, unauthenticated attacker can exploit this by sending a crafted POST request containing a malicious XML payload to the /cmisatom/ endpoint. Because the XML parser fails to properly restrict external entity references, an attacker can achieve local file inclusion (LFI) to read sensitive files (e.g., /etc/passwd) or perform Out-of-Band (OOB) data exfiltration. The vulnerability is patched in version 10.5.1.

## Affected products

- Alkacon OpenCms < 10.5.1

## Identifiers

- CVE-2023-42344
- GHSA-rcc6-6q2f-m2cw

## Timeline

- 2023-11-21: disclosed: Initial technical write-up published by watchTowr Labs
- 2026-05-08: advisory: GitHub Advisory and NVD entry published
- 2026-05-14: patched: Advisory updated to reflect patched status in 10.5.1

## References

- [https://labs.watchtowr.com/xxe-you-can-depend-on-me-opencms](https://labs.watchtowr.com/xxe-you-can-depend-on-me-opencms)
- [https://github.com/projectdiscovery/nuclei-templates/issues/8864](https://github.com/projectdiscovery/nuclei-templates/issues/8864)

## Related threats

- [Alkacon OpenCms XXE in CMIS AtomPub servlet](https://junglewise.ai/threats/cve-2023-42346-alkacon-opencms-xxe-in-cmis-atompub-servlet)
- [A Cross Site Scripting vulnerability in Alkacon OpenCms before 16 exists via updateModelGroups.jsp.](https://junglewise.ai/threats/cve-2023-42345-alkacon-opencms-xss-in-updatemodelgroups-jsp)
- [A Cross Site Scripting vulnerability in Alkacon OpenCms before 10.5.1 exists via cmis-online/type.](https://junglewise.ai/threats/cve-2023-42343-alkacon-opencms-xss-in-cmis-online-type)
- [OpenCMS Cross-Site Scripting vulnerability](https://junglewise.ai/threats/cve-2024-42699-opencms-cross-site-scripting-vulnerability)
- [OpenCMS cross-site scripting (XSS) vulnerability](https://junglewise.ai/threats/cve-2024-41446-opencms-cross-site-scripting-xss-vulnerability)