Is CVE-2023-42346 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2023-42346 being exploited in the wild.

How severe is CVE-2023-42346?

High severity, with a CVSS score of 7.5, published 8 May 2026.

Which products and versions are affected?

Alkacon OpenCms before 16.0; org.opencms:opencms-core (Maven) < 16.0, ECOSYSTEM:introduced=0,fixed=16.0.

Is there a fix for CVE-2023-42346?

Yes. org.opencms:opencms-core (Maven): upgrade to 16.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2023-42346 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2023-42346?

Check whether you run Alkacon OpenCms or org.opencms:opencms-core (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2023-42346: Alkacon OpenCms XXE in CMIS AtomPub servlet

Q: Is there a fix for CVE-2023-42346?

Yes. org.opencms:opencms-core (Maven): upgrade to 16.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2023-42346 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2023-42346?

Check whether you run Alkacon OpenCms or org.opencms:opencms-core (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2023-42346 · Severity: high · CVSS 7.5 · Published 2026-05-08

Alkacon OpenCms is an open-source content management system used by various enterprises to manage web content. A security vulnerability in how the system handles XML data allows an attacker to perform an XML External Entity (XXE) attack. This could allow an unauthenticated remote attacker to read sensitive files from the server or probe internal network resources, potentially leading to a breach of confidential information.

Technologies: Alkacon OpenCms, org.opencms:opencms-core (Maven). Vendors: Alkacon, Maven.

Quick answers

Is CVE-2023-42346 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2023-42346 being exploited in the wild.
How severe is CVE-2023-42346?: High severity, with a CVSS score of 7.5, published 8 May 2026.
Which products and versions are affected?: Alkacon OpenCms before 16.0; org.opencms:opencms-core (Maven) < 16.0, ECOSYSTEM:introduced=0,fixed=16.0.
Is there a fix for CVE-2023-42346?: Yes. org.opencms:opencms-core (Maven): upgrade to 16.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2023-42346 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2023-42346?: Check whether you run Alkacon OpenCms or org.opencms:opencms-core (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

org.opencms:opencms-core (Maven): upgrade to 16.0 or later

# set org.opencms:opencms-core to 16.0 in your pom.xml or build.gradle

Technical details

Alkacon OpenCms is vulnerable to an XML External Entity (XXE) injection vulnerability in its CMIS (Content Management Interoperability Services) implementation. The vulnerability exists within the 'CmisAtomPubServlet' (mapped to /cmisatom/*), which utilizes the Apache Chemistry library. Specifically, the /query endpoint fails to properly restrict external entity references in incoming XML POST requests. An unauthenticated attacker can exploit this by submitting a crafted XML document containing a DOCTYPE declaration pointing to an external or local DTD file. This can be used to perform out-of-band data exfiltration or local file disclosure (LFD) by leveraging existing DTDs on the filesystem (e.g., nmap.dtd). The issue is resolved in OpenCms version 16.0.

Affected products

Alkacon opencms-core < 16.0

Identifiers

CVE-2023-42346
GHSA-pj6p-9p8x-5mfc

Timeline

2023-11-21: disclosed: Initial research blog post by watchTowr Labs published
2026-05-08: advisory: GitHub Advisory and CVE published
2026-05-08: patched: OpenCms 16.0 released with fixes

References

https://labs.watchtowr.com/xxe-you-can-depend-on-me-opencms

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.