# CVE-2026-41917: OpenKM Local File Inclusion in administrative scripting interface

Source: https://junglewise.ai/threats/cve-2026-41917-openkm-local-file-inclusion-in-administrative-scripting-interface  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-26. Updated: 2026-05-26  
License: CC BY 4.0 with a link back

CVE-2026-41917 · Severity: medium · CVSS 4.9 · Published 2026-05-26

OpenKM, a document management system used to store and organize corporate records, contains a security flaw in its administrative interface. An authorized administrator can exploit this flaw to read any file on the underlying server, including sensitive system passwords and database credentials. This could lead to a full breach of the organization's documents and internal data.

Technologies: [OpenKM Community Edition](https://junglewise.ai/threats/technologies/openkm-community-edition), [OpenKM Pro Edition](https://junglewise.ai/threats/technologies/openkm-pro-edition). Vendors: [OpenKM](https://junglewise.ai/threats/vendors/openkm).

## Quick answers

**Is CVE-2026-41917 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-41917 being exploited in the wild.

**How severe is CVE-2026-41917?** Medium severity, with a CVSS score of 4.9, published 26 May 2026.

**Which products and versions are affected?** OpenKM Community Edition 6.3.12 and earlier; OpenKM Pro Edition 7.1.47 and earlier.

**Is there a fix for CVE-2026-41917?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-41917 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-41917?** Check whether you run OpenKM Community Edition or OpenKM Pro Edition at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A local file inclusion (LFI) vulnerability exists in the OpenKM administrative scripting interface at the /admin/Scripting endpoint. The vulnerability is caused by improper validation of the 'fsPath' parameter when the 'action' parameter is set to 'Load'. An authenticated user with administrative privileges can supply arbitrary filesystem paths to read sensitive files, such as /etc/passwd, database configuration files, or JVM keystores, under the context of the OpenKM process. While the vendor has not released a formal patch, researchers recommend disabling administrative scripting and restricting filesystem access as immediate mitigations.

## Affected products

- OpenKM OpenKM Community Edition 6.3.12 and earlier
- OpenKM OpenKM Pro Edition 7.1.47 and earlier

## Timeline

- 2026-01-16: disclosed: Initial disclosure by Terra System Labs
- 2026-04-29: other: Exploit code published to Exploit-DB
- 2026-05-26: advisory: NVD publication date

## References

- [https://github.com/terrasystemlabs/Exploits/tree/main/OpenKM-Exploits](https://github.com/terrasystemlabs/Exploits/tree/main/OpenKM-Exploits)
- [https://github.com/terrasystemlabs/Exploits/tree/main/OpenKM-Exploits/nuclei-templates/openkm-local-file-execution](https://github.com/terrasystemlabs/Exploits/tree/main/OpenKM-Exploits/nuclei-templates/openkm-local-file-execution)
- [https://hub.docker.com/r/openkm/openkm-ce](https://hub.docker.com/r/openkm/openkm-ce)
- [https://terrasystemlabs.com/post?slug=openkm-zero-day-vulnerabilities-terra-system-labs](https://terrasystemlabs.com/post?slug=openkm-zero-day-vulnerabilities-terra-system-labs)
- [https://www.exploit-db.com/exploits/52520](https://www.exploit-db.com/exploits/52520)
- [https://www.openkm.com/](https://www.openkm.com/)
- [https://www.vulncheck.com/advisories/openkm-local-file-inclusion-via-admin-scripting](https://www.vulncheck.com/advisories/openkm-local-file-inclusion-via-admin-scripting)

## Related threats

- [OpenKM remote code execution in administrative scripting interface](https://junglewise.ai/threats/cve-2026-42785-openkm-remote-code-execution-in-administrative-scripting)
- [OpenKM unrestricted SQL execution in DatabaseQuery interface](https://junglewise.ai/threats/cve-2026-42425-openkm-unrestricted-sql-execution-in-databasequery-interface)