Executive brief
OpenKM, a document management system used by enterprises to store and manage sensitive files, contains a vulnerability in its administrative database interface. An authenticated administrator can execute unrestricted database commands, allowing them to view sensitive user information, modify permissions, or delete records. This could lead to a total compromise of the application's data integrity and confidentiality.
Technical details
An unrestricted SQL execution vulnerability exists in OpenKM Community Edition 6.3.12 and Pro Edition 7.1.47. The vulnerability is located in the DatabaseQuery interface at the /admin/DatabaseQuery endpoint. An authenticated user with administrative privileges can submit arbitrary SQL queries via the 'qs' parameter. This allows for full interaction with the underlying database, including the extraction of password hashes from the OKM_USER table, modification of user roles, or deletion of documents and audit logs. As of the advisory date, no official patch is available, and it is recommended to disable the database query interface in production environments.
Affected products
- OpenKM OpenKM Community Edition 6.3.12
- OpenKM OpenKM Pro Edition 7.1.47
Timeline
- 2026-01-16: disclosed: Initial discovery and write-up by Terra System Labs
- 2026-04-29: other: Exploit code published to Exploit-DB (EDB-ID 52520)
- 2026-05-26: advisory: CVE published to NVD
References
- https://github.com/terrasystemlabs/Exploits/tree/main/OpenKM-Exploits
- https://github.com/terrasystemlabs/Exploits/tree/main/OpenKM-Exploits/nuclei-templates/openkm-sql-database-query
- https://hub.docker.com/r/openkm/openkm-ce
- https://terrasystemlabs.com/post?slug=openkm-zero-day-vulnerabilities-terra-system-labs
- https://www.exploit-db.com/exploits/52520
- https://www.openkm.com/
- https://www.vulncheck.com/advisories/openkm-unrestricted-sql-execution-via-databasequery