Multiple Vulnerabilities in OpenKM Community Edition

Posted date 13/11/2026

Identificador

INCIBE-2026-895

Importance

4 - High

Affected Resources

OpenKM Community Edition, versions 6.3.3 through 6.3.13 and 7.0.3; FormUtils / LocalEntityResolver components.
OpenKM Community Edition, versions 6.3.12 and 6.3.13; workflow definition management. The 7.x branch is not affected by this vulnerability, as it does not include the jBPM engine.

Description

INCIBE has coordinated the disclosure of two high severity vulnerabilities affecting OpenKM Community Edition from Open Knowledge Management System S.L. (OpenKM), a document management system. The vulnerabilities were discovered by Carlos Alejandro Smith Tay (Las3rs).

These vulnerabilities have been assigned the following codes, CVSS v4.0 base scores, CVSS vectors, and CWE vulnerability types:

CVE-2026-112181: CVSS v4.0: 8.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N | CWE-611
CVE-2026-112182: CVSS v4.0: 8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | CWE-862

Solution

Update OpenKM CE 7.0.3 to 7.0.4, which has already been released. According to the manufacturer, the entity resolver has been fixed, and general and parameter external entities have been disabled by enabling FEATURE_SECURE_PROCESSING. For versions 6.3.3 through 6.3.13, the fix will be included in 6.3.14, which is pending release; HTTP requests for non-local DTDs have also been removed.
Update to OpenKM CE 6.3.14 when it becomes available. The vendor states that creating and deleting process definitions will require the administrator role at the business layer, covering REST, SOAP, and the administration interface.

As a temporary measure to restrict access to the workflow, the vendor recommends blocking non-administrator users from accessing /OpenKM/services/rest/workflow/* and /OpenKM/services/OKMWorkflow on the reverse proxy or firewall. If the web services are not in use, block the entire /OpenKM/services/* directory.

The manufacturer recommends migrating to OpenKM CE 7.0.4. Before migrating from 6.3.x, please note that 7.x does not include the jBPM workflow engine.

Detail

CVE-2026-112181: vulnerability due to inadequate restriction of references to external XML entities in OpenKM Community Edition. The XML processing in FormUtils / LocalEntityResolver does not properly restrict the resolution of external resources. An authenticated remote attacker with the ROLE_USER role can exploit the flaw via a REST request. In the 6.3.x branch, this allows the attacker to trigger HTTP requests under their control (SSRF); in 7.0.3, it allows the attacker to read local files and access internal HTTP resources from the server.
CVE-2026-112182: unauthorization vulnerability in the management of workflow definitions in OpenKM Community Edition. The REST endpoints `registerProcessDefinition` and `runProcessDefinition` require authentication but do not verify roles in the WorkflowService or in lower layers. An attacker with the `ROLE_USER` role can register and execute a process definition containing BeanShell scripts, allowing them to execute Java code and operating system commands with the service’s privileges. In the official Docker image, the process runs as root.

CVE