CVE-2026-41917: OpenKM Path Traversal Vulnerability

CVE-2026-41917 Overview

CVE-2026-41917 is a Local File Inclusion (LFI) vulnerability in OpenKM 6.3.12, an open-source document management system. The flaw resides in the administrative scripting interface at /admin/Scripting and allows authenticated administrators to read arbitrary files from the host filesystem. Attackers supply a controlled path through the fsPath parameter combined with action=Load to retrieve sensitive content. Targets include /etc/passwd, OpenKM configuration files containing database credentials, and Java Virtual Machine (JVM) keystores accessible to the OpenKM service account. The issue is classified under CWE-22 (Path Traversal).

Critical Impact
An authenticated administrator can exfiltrate database credentials and cryptographic keystores, enabling lateral movement and full compromise of OpenKM-managed data repositories.

Affected Products

OpenKM Community Edition 6.3.12
OpenKM deployments using the openkm/openkm-ce Docker image
OpenKM installations exposing the /admin/Scripting administrative interface

Discovery Timeline

2026-05-26 - CVE-2026-41917 published to NVD
2026-05-26 - Last updated in NVD database

Technical Details for CVE-2026-41917

Vulnerability Analysis

The vulnerability stems from improper validation of the fsPath request parameter accepted by the OpenKM administrative scripting endpoint. When an authenticated administrator submits a request to /admin/Scripting with action=Load, the application opens and returns the file referenced by fsPath without restricting the path to an allowed directory. The endpoint does not canonicalize the input or apply a whitelist, so absolute paths and directory traversal sequences resolve to arbitrary locations on the host filesystem. Files are read using the privileges of the OpenKM Java process, which typically owns configuration files, log directories, and JVM keystores. Successful exploitation discloses plaintext database credentials stored in OpenKM.cfg, private keys from cacerts or custom keystores, and operating system files such as /etc/passwd. The disclosed credentials enable database compromise and downstream attacks against integrated systems.

Root Cause

The administrative scripting handler treats fsPath as a trusted server-side filesystem reference instead of validating it against an allow-list of script locations. There is no canonical path check, no jail to a base directory, and no separation between the script-loading function and arbitrary file reads. The privilege model also assumes administrators should have unrestricted filesystem access, which conflicts with least privilege and produces an LFI primitive ([CWE-22]).

Attack Vector

Exploitation requires valid administrator credentials and network access to the OpenKM web interface. An attacker authenticates to OpenKM, then issues an HTTP request to /admin/Scripting with the parameters action=Load and fsPath= set to the absolute path of the target file, for example /etc/passwd or the path to OpenKM.cfg. The server returns the file contents in the response body. The vulnerability mechanism and request structure are documented in the VulnCheck OpenKM LFI Advisory, the Terra System Labs Zero-Day Post, and the Exploit-DB entry #52520. A Nuclei detection template is published in the GitHub OpenKM LFI Template repository.

Detection Methods for CVE-2026-41917

Indicators of Compromise

HTTP requests to /admin/Scripting containing the parameter action=Load combined with an absolute filesystem path in fsPath.
Access patterns referencing sensitive targets such as fsPath=/etc/passwd, fsPath=/opt/openkm/OpenKM.cfg, or paths ending in cacerts or .jks.
Outbound data transfer from the OpenKM host immediately following administrator authentication and /admin/Scripting activity.

Detection Strategies

Inspect web server and application logs for GET or POST requests to /admin/Scripting where fsPath contains .., an absolute path, or references to configuration and keystore files.
Deploy the published Nuclei template from the GitHub OpenKM Exploits repository against internal OpenKM deployments to confirm exposure.
Correlate administrative logins with subsequent file-read activity to surface credential misuse or compromised admin accounts.

Monitoring Recommendations

Forward OpenKM access logs and Tomcat catalina logs to a SIEM and alert on /admin/Scripting requests containing the fsPath parameter.
Monitor read access to OpenKM.cfg, JVM cacerts, and other keystore files at the filesystem layer using auditd or equivalent.
Track administrator session anomalies including new source IPs, off-hours logins, and rapid sequential file-load operations.

How to Mitigate CVE-2026-41917

Immediate Actions Required

Restrict network access to /admin/Scripting using a reverse proxy or firewall rule, allowing only trusted administrative IP ranges.
Rotate all credentials and secrets that may have been exposed through OpenKM configuration files, including database passwords and keystore passphrases.
Audit OpenKM administrator accounts, disable unused accounts, and enforce multi-factor authentication on the upstream identity provider.

Patch Information

No vendor-supplied patch is referenced in the NVD entry or linked advisories at the time of publication. Consult the OpenKM Official Website and the VulnCheck OpenKM LFI Advisory for any subsequent fix releases. Until a patched version is available, treat the administrative scripting interface as untrusted and apply compensating controls.

Workarounds

Block external access to /admin/Scripting at the web server, load balancer, or WAF layer.
Run the OpenKM Java process under a dedicated low-privilege user account that cannot read /etc/passwd, system keystores, or unrelated application files.
Relocate sensitive configuration files outside the OpenKM process's readable paths where deployment topology allows.
Apply a WAF rule that denies requests to /admin/Scripting where fsPath contains absolute paths or traversal sequences such as ../.

bash

# Example nginx configuration to block exploitation of CVE-2026-41917
location = /admin/Scripting {
    if ($arg_action = "Load") { return 403; }
    if ($arg_fsPath ~* "^/|\.\./") { return 403; }
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://openkm_backend;
}