Junglewise Threat Intelligence

CVE-2026-42785: OpenKM remote code execution in administrative scripting interface

CVE-2026-42785 · Severity: high · CVSS 7.2 · Published 2026-05-26

Technologies: OpenKM Community Edition, OpenKM Pro Edition. Vendors: OpenKM.

Executive brief

OpenKM, a document management system used by enterprises to store and manage sensitive records, contains a vulnerability in its administrative interface. An attacker with administrative credentials can execute arbitrary commands on the underlying server by submitting malicious scripts through the application's scripting tool. This could lead to a total system takeover, allowing unauthorized access to all stored documents, data theft, or the installation of persistent malware.

Technical details

A remote code execution (RCE) vulnerability exists in OpenKM Community Edition 6.3.12 and Pro Edition 7.1.47 due to improper control of generation of code (CWE-94) within the administrative scripting interface. The application provides a BeanShell interpreter at the /admin/Scripting endpoint that evaluates user-supplied Java code without sandboxing or command filtering. An authenticated attacker with administrative privileges can submit a script with the 'action=Evaluate' parameter to execute arbitrary operating system commands in the context of the application server. This allows for full system compromise, including file system access and lateral movement. As of the advisory date, no official patch is available, and mitigations include disabling the administrative scripting interface.

Affected products

  • OpenKM OpenKM Community Edition 6.3.12 and earlier
  • OpenKM OpenKM Pro Edition 7.1.47 and earlier

Timeline

  • 2026-01-16: disclosed: Initial discovery and report by Terra System Labs
  • 2026-04-29: other: Exploit code published on Exploit-DB
  • 2026-05-26: advisory: CVE published to NVD dataset

References

Related threats