What is the CVSS score of CVE-2026-38429?

CVE-2026-38429 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of OpenCMS are affected by CVE-2026-38429?

OpenCMS versions through v20 contain a critical XML External Entity (XXE) injection vulnerability in the Admin Import DB feature that could allow attackers with administrative access to execute…

How to fix or mitigate CVE-2026-38429?

Within 24 hours: Identify all OpenCMS v20 and earlier deployments and restrict network access to the Admin Import DB feature to trusted internal IP ranges only; document current administrative user accounts with import privileges. Within 7 days: Apply the upstream fix via GitHub commit e3e41e5a if your deployment supports direct commit-based patching, or await a formal tagged release version from the OpenCMS project; if neither is feasible, disable the Admin Import DB feature entirely until an official patch is available. Within 30 days: Verify patch application across all OpenCMS instances, audit logs for any suspicious .zip file uploads to the import feature, and conduct access reviews to ensure only essential administrators retain import privileges.

OpenCMS CVE-2026-38429

EUVD-2026-27401 CRITICAL

Improper Restriction of XML External Entity Reference (CWE-611)

2026-05-05 mitre

XXE N A

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

May 06, 2026 - 21:30 vuln.today

Analysis Generated

May 06, 2026 - 21:30 vuln.today

CVSS changed

May 06, 2026 - 19:22 NVD

9.8 (CRITICAL)

CVE Published

May 05, 2026 - 00:00 nvd

CRITICAL 9.8

DescriptionCVE.org

OpenCMS v20 and before is vulnerable to XML External Entity (XXE) in the Admin Import DB feature due to insecure XML parsing of user supplied .zip files containing a manifest.xml.

AnalysisAI

XML External Entity injection in OpenCMS (versions through v20) allows remote unauthenticated attackers to achieve information disclosure, server-side request forgery, or arbitrary code execution via malicious .zip files uploaded to the Admin Import DB feature. The vulnerability stems from unsafe XML parsing of manifest.xml files within these archives. Despite a maximum CVSS 9.8 score, the real-world risk is limited by the administrative-only attack surface - exploitation requires access to privileged admin import functionality. No active exploitation confirmed (not in CISA KEV), and EPSS score of 0.03% (7th percentile) indicates minimal observed threat activity. Upstream fix available via GitHub commit e3e41e5a, though a tagged release version has not been independently verified.

Technical ContextAI

OpenCMS is a Java-based enterprise content management system. This vulnerability (CWE-611: Improper Restriction of XML External Entity Reference) exists in the database import functionality across all version 2-5 import handlers (CmsImportVersion2 through CmsImportVersion5). The flaw occurs when unmarshalHelper() methods parse manifest.xml from user-uploaded .zip archives without an entity resolver, passing null as the EntityResolver parameter. This permits XML documents to reference external entities, enabling XXE attacks. The fix introduces CmsXmlEntityResolver to disable external entity resolution during XML unmarshalling. OpenCMS uses the dom4j library for XML processing, and the vulnerable code paths also affect mergePageFile operations in version 2 imports. CPE data is incomplete (n/a:n/a), but the GitHub repository confirms the affected product is alkacon/opencms-core.

RemediationAI

Upstream fix available via GitHub commit e3e41e5a96d71383279e7d23c627efc9934008c1 (https://github.com/alkacon/opencms-core/commit/e3e41e5a96d71383279e7d23c627efc9934008c1), which replaces null entity resolvers with CmsXmlEntityResolver instances across all vulnerable import classes. A released patched version number has not been independently confirmed from available data - organizations should monitor the OpenCMS release notes and apply the first version incorporating this commit. As interim compensating controls, restrict access to the Admin Import DB feature to only essential administrators through role-based access controls, ideally accessible only from trusted internal networks or via VPN. Implement network-level controls to prevent the OpenCMS server from making outbound connections to untrusted destinations, limiting XXE exfiltration and SSRF impact. These mitigations reduce but do not eliminate risk, as authenticated admins could still be targeted via social engineering. File upload validation (scanning .zip contents before import) provides limited protection since malicious XML is only evaluated during unmarshalling.