Unrestricted SQL Execution Vulnerability in OpenKM by OpenKM
CVE-2026-42425

8.6HIGH

Key Information:

Vendor

Openkm

Status
Openkm Community Edition
Openkm Professional Edition
Vendor
CVE Published:
26 May 2026

Badges

👾 Exploit Exists

What is CVE-2026-42425?

OpenKM 6.3.12 is susceptible to an unrestricted SQL execution vulnerability that compromises the application database through the DatabaseQuery interface. Authenticated administrative users can exploit this flaw by injecting SQL queries via the qs parameter on the /admin/DatabaseQuery endpoint. This allows unauthorized access to sensitive data, such as usernames and password hashes from the OKM_USER table. Additionally, the vulnerability may enable attackers to alter permissions or delete critical database records, posing a serious risk to data integrity and confidentiality.

Affected Version(s)

OpenKM Community Edition 0 <= 6.3.12

OpenKM Professional Edition 0 <= 7.1.47

References

https://www.exploit-db.com/exploits/52520
exploit
https://www.openkm.com/
product
https://hub.docker.com/r/openkm/openkm-ce
product

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Terra System Labs Pvt. Ltd.
.