Is there a public PoC exploit available for CVE-2026-41917?

Yes, a public proof-of-concept exploit is available for CVE-2026-41917. Prioritise patching immediately. EPSS: 0.0%.

OpenKM CVE-2026-41917

Q: What is the CVSS score of CVE-2026-41917?

CVE-2026-41917 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31833 MEDIUM

Path Traversal (CWE-22)

2026-05-26 VulnCheck

GHSA-hf34-4jm2-f8qq

Path Traversal Openkm Openkm Community Edition Openkm Professional Edition

6.9

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulnCheck) · only source for this CVE.

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 12:20 vuln.today

CVSS changed

May 26, 2026 - 15:22 NVD

4.9 (MEDIUM) 6.9 (MEDIUM)

DescriptionCVE.org

OpenKM 6.3.12 contains a local file inclusion vulnerability in the administrative scripting interface at /admin/Scripting that allows authenticated administrators to read arbitrary files by supplying an attacker-controlled filesystem path through the fsPath parameter with action=Load. Attackers can exploit this to access sensitive files including /etc/passwd, configuration files containing database credentials, and JVM keystores accessible to the OpenKM process.

AnalysisAI

Path traversal in OpenKM's administrative scripting interface exposes arbitrary server-side files to authenticated administrators who supply attacker-controlled paths via the fsPath parameter at /admin/Scripting with action=Load. Both the Community Edition (≤6.3.12) and Professional Edition (≤7.1.47) are affected, enabling exfiltration of /etc/passwd, database credential files, and JVM keystores accessible to the OpenKM process. No public exploit identified at time of analysis as a KEV entry, but publicly available exploit code exists via Exploit-DB (52520) and Terra System Labs' GitHub repository, raising the realistic risk for environments where admin credentials are shared, weak, or previously compromised.

Technical ContextAI

OpenKM is a Java-based document management system available in Community and Professional editions (CPE: cpe:2.3:a:openkm:openkm_community_edition and cpe:2.3:a:openkm:openkm_professional_edition). The vulnerability is rooted in CWE-22 (Improper Limitation of a Pathname to a Restricted Directory - 'Path Traversal'). The /admin/Scripting endpoint accepts a fsPath parameter that is passed directly to file-system read operations without adequate sanitization or path canonicalization, allowing any authenticated administrator to reference absolute filesystem paths outside the intended document repository. Because OpenKM runs as a JVM process, the accessible file scope is bounded only by the OS-level permissions of the Java process user, which in default or containerized deployments may be broad enough to reach credential stores, keystores, and system files.

RemediationAI

No vendor-released patch identified at time of analysis - the Terra System Labs advisory characterized this as a zero-day at disclosure, and no fixed version number appears in NVD, EUVD, or VulnCheck data. Organizations should consult the OpenKM vendor directly at https://www.openkm.com/ and monitor the VulnCheck advisory at https://www.vulncheck.com/advisories/openkm-local-file-inclusion-via-admin-scripting for patch availability. In the interim, restrict network access to the /admin/Scripting endpoint using a reverse proxy or WAF rule that blocks requests where the fsPath parameter contains absolute path prefixes (e.g., /) or traversal sequences (../); note this may disrupt legitimate administrative scripting workflows. Enforce strong, unique credentials for all OpenKM administrator accounts and enable multi-factor authentication if supported. Review the OS-level permissions of the OpenKM JVM process user and apply the principle of least privilege - running the process as a dedicated low-privilege user limits the file scope an attacker can reach even if exploitation occurs. Audit administrator account activity for anomalous use of the /admin/Scripting endpoint.