Is CVE-2026-42425 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-42425 being exploited in the wild.

How severe is CVE-2026-42425?

High severity, with a CVSS score of 7.2, published 26 May 2026.

Which products and versions are affected?

OpenKM Community Edition 6.3.12; OpenKM Pro Edition 7.1.47.

Is there a fix for CVE-2026-42425?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-42425 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-42425?

Check whether you run OpenKM Community Edition or OpenKM Pro Edition at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42425: OpenKM unrestricted SQL execution in DatabaseQuery interface

CVE-2026-42425 · Severity: high · CVSS 7.2 · Published 2026-05-26

OpenKM, a document management system used by enterprises to store and manage sensitive files, contains a vulnerability in its administrative database interface. An authenticated administrator can execute unrestricted database commands, allowing them to view sensitive user information, modify permissions, or delete records. This could lead to a total compromise of the application's data integrity and confidentiality.

Technologies: OpenKM Community Edition, OpenKM Pro Edition. Vendors: OpenKM.

Quick answers

Is CVE-2026-42425 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-42425 being exploited in the wild.
How severe is CVE-2026-42425?: High severity, with a CVSS score of 7.2, published 26 May 2026.
Which products and versions are affected?: OpenKM Community Edition 6.3.12; OpenKM Pro Edition 7.1.47.
Is there a fix for CVE-2026-42425?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-42425 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-42425?: Check whether you run OpenKM Community Edition or OpenKM Pro Edition at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An unrestricted SQL execution vulnerability exists in OpenKM Community Edition 6.3.12 and Pro Edition 7.1.47. The vulnerability is located in the DatabaseQuery interface at the /admin/DatabaseQuery endpoint. An authenticated user with administrative privileges can submit arbitrary SQL queries via the 'qs' parameter. This allows for full interaction with the underlying database, including the extraction of password hashes from the OKM_USER table, modification of user roles, or deletion of documents and audit logs. As of the advisory date, no official patch is available, and it is recommended to disable the database query interface in production environments.

Affected products

OpenKM OpenKM Community Edition 6.3.12
OpenKM OpenKM Pro Edition 7.1.47

Timeline

2026-01-16: disclosed: Initial discovery and write-up by Terra System Labs
2026-04-29: other: Exploit code published to Exploit-DB (EDB-ID 52520)
2026-05-26: advisory: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.