CVE-2026-42785: OpenKM 6.3.12 RCE Vulnerability

CVE-2026-42785 Overview

CVE-2026-42785 is a remote code execution vulnerability in OpenKM 6.3.12, an open-source document management platform. The flaw resides in the /admin/Scripting endpoint, which accepts Java and BeanShell code from authenticated administrators. Attackers can submit malicious script content with an action=Evaluate parameter to execute operating system commands in the context of the OpenKM application server. Successful exploitation grants the attacker the same privileges as the OpenKM service account, enabling full server compromise.

Critical Impact
Authenticated administrators can execute arbitrary operating system commands on the OpenKM application server through the built-in scripting interface, leading to complete server takeover.

Affected Products

OpenKM Community Edition 6.3.12
OpenKM deployments using the /admin/Scripting endpoint
Docker images based on openkm/openkm-ce

Discovery Timeline

2026-05-26 - CVE-2026-42785 published to NVD
2026-05-26 - Last updated in NVD database

Technical Details for CVE-2026-42785

Vulnerability Analysis

The vulnerability is classified as Improper Control of Generation of Code [CWE-94], commonly referred to as Code Injection. OpenKM 6.3.12 exposes an administrative scripting console at /admin/Scripting that accepts BeanShell and Java code for evaluation. When an authenticated administrator submits a POST request with action=Evaluate and script content, the application executes that script inside the running Java Virtual Machine. Because BeanShell supports calls to Runtime.getRuntime().exec() and similar APIs, the feature provides a direct path to operating system command execution.

The attackVector is Network, and exploitation requires high privileges (administrator credentials). However, OpenKM ships with well-known default administrator accounts, and credential reuse or weak password policies make privilege acquisition realistic in many deployments.

Root Cause

The root cause is a designed-in administrative feature that evaluates untrusted script input without sandboxing. The /admin/Scripting endpoint passes user-supplied content directly to the BeanShell interpreter, which has full access to the Java runtime and underlying operating system. No allowlisting, sandbox, or Java SecurityManager policy restricts the available API surface.

Attack Vector

An attacker authenticates to the OpenKM web interface with administrator privileges, then issues an HTTP POST request to /admin/Scripting containing the action=Evaluate parameter and a BeanShell payload. The payload invokes Java methods such as Runtime.exec() to spawn shell processes, read or write files, or establish reverse shells. The commands execute under the user account running the OpenKM application server, typically a Tomcat or Java service account.

A public proof-of-concept and a Nuclei detection template are published in the Terrasystem Labs Exploits repository, along with Exploit-DB entry #52520 and the VulnCheck advisory.

Detection Methods for CVE-2026-42785

Indicators of Compromise

HTTP POST requests to /admin/Scripting containing the parameter action=Evaluate.
Child processes such as sh, bash, cmd.exe, or powershell.exe spawned by the OpenKM Java process (commonly java or catalina).
Unexpected outbound network connections from the OpenKM server immediately following administrative login events.
New or modified files in the OpenKM web application or Tomcat webapps directory that were not introduced by a vendor update.

Detection Strategies

Inspect web server access logs for requests matching POST /admin/Scripting and correlate with administrator session identifiers.
Use the public Nuclei template to scan internal OpenKM instances for the vulnerable endpoint.
Configure endpoint protection to alert when the Java process running OpenKM spawns a command interpreter or scripting host as a child process.

Monitoring Recommendations

Forward OpenKM application logs, Tomcat access logs, and host process telemetry to a centralized log platform for correlation.
Alert on any successful authentication to the OpenKM admin interface from non-administrative source networks.
Baseline the expected process tree of the OpenKM Java service and alert on deviations such as new child processes or unusual command lines.

How to Mitigate CVE-2026-42785

Immediate Actions Required

Restrict network access to the /admin/Scripting endpoint using a reverse proxy or web application firewall, allowing only trusted management IP ranges.
Rotate all OpenKM administrator credentials and remove default or shared administrator accounts.
Audit recent access logs for unexpected POST requests to /admin/Scripting and investigate any matches for signs of compromise.
Enforce multi-factor authentication on administrator accounts where the deployment supports it through an upstream identity provider.

Patch Information

At the time of publication, no vendor patch is listed in the NVD record. Administrators should monitor the OpenKM official website and the VulnCheck advisory for fix availability and apply updates as soon as they are released.

Workarounds

Block external access to /admin/Scripting at the reverse proxy or load balancer until a vendor fix is available.
Disable or remove the scripting feature in OpenKM configuration if it is not required for operational workflows.
Run the OpenKM Java process under a least-privileged service account with no shell access and minimal file system permissions to limit the blast radius of successful exploitation.
Place the OpenKM server in a segmented network zone that restricts outbound traffic to only required destinations.

bash

# Example NGINX configuration to block external access to the scripting endpoint
location = /admin/Scripting {
    allow 10.0.0.0/8;        # internal management network
    deny all;
    proxy_pass http://openkm_backend;
}