OpenCMS CVE-2026-38429

Exploitation requires the attacker to have access to the OpenCMS Admin Import DB feature, which is typically restricted to authenticated administrator accounts. The attack surface is limited to installations where administrative interfaces are accessible to the attacker - either through compromised admin credentials, exposed admin panels on untrusted networks, or post-exploitation lateral movement scenarios. Default OpenCMS configurations protect the admin interface behind authentication, making this effectively an authenticated, privileged-user attack vector (though CVSS vector shows PR:N, reflecting the absence of authentication in the XML parsing function itself rather than the admin panel access control). No specific OpenCMS configuration settings beyond default admin functionality are required. All OpenCMS versions through v20 with unpatched import handlers are vulnerable when the admin import feature is used.

CVSS 9.8 reflects theoretical worst-case impact: network-accessible (AV:N), low complexity (AC:L), no authentication required (PR:N), with high confidentiality, integrity, and availability impact. However, this assessment conflicts with the realistic attack surface - the Admin Import DB feature targeted by this XXE is only accessible to authenticated CMS administrators in standard deployments. EPSS exploitation probability of 0.03% (7th percentile) aligns with the lack of observed real-world abuse and absence from CISA KEV, indicating this is not actively exploited. The GitHub commit fixes the vulnerability through secure XML parsing configuration, a straightforward remediation with minimal operational impact. Primary risk exposure is in environments where administrative interfaces are exposed to untrusted networks or where lateral movement after initial compromise could grant access to admin import features. Organizations should prioritize this based on whether OpenCMS admin panels are internet-facing and whether least-privilege access controls limit use of import functionality. The high CVSS score overstates practical risk for most deployments where admin access is properly restricted.

An attacker with access to the OpenCMS administrative interface crafts a malicious .zip file containing a specially-crafted manifest.xml file with external entity declarations pointing to sensitive local files (e.g., file:///etc/passwd) or internal network resources (e.g., http://internal-service/api). When an administrator uploads this archive via the Admin Import DB feature, the vulnerable XML parser processes the external entities, potentially disclosing file contents in error messages or server responses, or enabling server-side request forgery to probe internal systems. In worst-case scenarios with specific XML parser configurations, this could escalate to remote code execution.