Vulnerability · Published May 26, 2026 · Assigned by VulnCheck
CVE-2026-42785OpenKM 6.3.12 Remote Code Execution via Administrative Scripting
High 7.2
In plain English
A high-severity code injection in OpenKM Community Edition from Openkm. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities).
Severity (CVSS 3.1)7.2High
Exploit odds (30 days)0.7%top 47.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
OpenKM 6.3.12 contains a remote code execution vulnerability that allows authenticated administrators to execute arbitrary Java/BeanShell code through the /admin/Scripting endpoint. Attackers can submit malicious script content with an action=Evaluate parameter to execute operating system commands in the context of the OpenKM application server.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Openkm | OpenKM Community Edition | 0 – through 6.3.12 |
| Openkm | OpenKM Professional Edition | 0 – through 7.1.47 |
Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
References
- ExploitDB-52520 exploit
- Official Product Homepage product
- Product Reference product
- Vulnerability Advisory vendor-advisory
- Proof-of-Concept Toolkit product
- Nuclei Detection Template product
- VulnCheck Advisory: OpenKM 6.3.12 Remote Code Execution via Administrative Scripting third-party-advisory