Which versions of OpenKM are affected by CVE-2026-42425?

OpenKM Community Edition (≤6.3.12) and Professional Edition (≤7.1.47) contain an authenticated SQL injection in the administrative database query interface, enabling administrative users to extract…

Is there a public PoC exploit available for CVE-2026-42425?

Yes, a public proof-of-concept exploit is available for CVE-2026-42425. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-42425?

Within 24 hours: Immediately isolate internet-facing OpenKM instances or implement strict network access controls; force password reset for all administrative accounts and enforce multi-factor authentication. Within 7 days: Review audit logs for unauthorized /admin/DatabaseQuery endpoint access; document OpenKM versions across infrastructure. Within 30 days: Monitor for vendor patches; establish rapid deployment procedures for when updates become available; validate WAF/firewall rules restricting public administrative access.

OpenKM CVE-2026-42425

Q: What is the CVSS score of CVE-2026-42425?

CVE-2026-42425 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31834 HIGH

SQL Injection (CWE-89)

2026-05-26 VulnCheck

GHSA-2445-qj53-662g

Information Disclosure SQLi Openkm Openkm Community Edition Openkm Professional Edition

8.6

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulnCheck) · only source for this CVE.

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 10:00 vuln.today

CVSS changed

May 26, 2026 - 15:22 NVD

7.2 (HIGH) 8.6 (HIGH)

DescriptionCVE.org

OpenKM 6.3.12 contains an unrestricted SQL execution vulnerability that allows authenticated administrative users to execute arbitrary SQL statements against the application database via the DatabaseQuery interface. Attackers can submit malicious SQL queries through the qs parameter to the /admin/DatabaseQuery endpoint to extract sensitive data including usernames and password hashes from the OKM_USER table, modify permissions, or delete database records.

AnalysisAI

Authenticated SQL injection in OpenKM Community Edition (≤6.3.12) and Professional Edition (≤7.1.47) lets administrative users execute arbitrary SQL against the application database through the /admin/DatabaseQuery endpoint's qs parameter. Publicly available exploit code exists (Exploit-DB 52520 and a Nuclei template from Terra System Labs), enabling dumping of password hashes from OKM_USER, permission tampering, and data destruction. EPSS is very low (0.03%) and the bug requires high privileges (PR:H), so real-world risk is bounded but meaningful for any internet-facing OpenKM instance with weak admin credentials.

Technical ContextAI

OpenKM is a Java-based open-source document management system distributed in Community and Professional editions, commonly deployed via Tomcat or the official Docker image (hub.docker.com/r/openkm/openkm-ce). The flaw is a CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) issue in the administrative DatabaseQuery feature, which is a built-in interface intended for DBA-style ad-hoc queries. Rather than filtering or sandboxing the queries, the qs parameter is passed largely unrestricted to the backing JDBC layer, so any SQL the underlying database (MySQL, PostgreSQL, Oracle, etc.) accepts will execute with the privileges of OpenKM's database user - typically full read/write on the OKM_* schema including OKM_USER, which stores credential hashes. Affected CPEs are cpe:2.3:a:openkm:openkm_community_edition:* and cpe:2.3:a:openkm:openkm_professional_edition:*.

RemediationAI

No vendor-released patch identified at time of analysis - the references include the vendor site and the Terra System Labs / VulnCheck advisories but no fixed version is published for Community 6.3.12 or Professional 7.1.47, so operators should monitor https://www.openkm.com/ and the VulnCheck advisory (https://www.vulncheck.com/advisories/openkm-unrestricted-sql-execution-via-databasequery) for an upstream fix. As compensating controls, restrict access to /admin/DatabaseQuery at the reverse proxy or WAF (deny all external traffic; allow only specific admin source IPs), since this endpoint has no legitimate end-user use case and blocking it removes the attack surface at the cost of losing the ad-hoc DBA query UI for administrators (who can use a direct DB client instead). Rotate all administrator credentials and enforce strong/unique passwords plus MFA on the admin role to make the PR:H precondition harder to satisfy, and run the OpenKM database user with least privilege (no DROP/ALTER on non-OKM schemas, no FILE/xp_cmdshell-equivalent privileges) to limit blast radius if exploitation succeeds. Finally, treat existing OKM_USER password hashes as compromised on any instance suspected of exposure and force a password reset.