OpenKM CVE-2026-42785

Exploitation requires (1) network reachability to the OpenKM web interface, specifically the /admin/Scripting endpoint, and (2) valid credentials for an account in the OpenKM administrator role (CVSS PR:H) - there is no separate token, CSRF defence, or out-of-band approval gating the Evaluate action. The vulnerable feature is the built-in BeanShell scripting console, which is present and enabled by default in Community Edition ≤6.3.12 and Professional Edition ≤7.1.47 with no special configuration toggle required. Limiting factors: a non-admin authenticated user cannot reach the endpoint, no user interaction by a victim is needed (UI:N), and the impact is confined to the OpenKM application/host (SC:N/SI:N/SA:N) - meaning compromise does not automatically cross into separately-administered downstream systems unless the OpenKM host has additional trust relationships.

CVSS 4.0 vector AV:N/AC:L/AT:N/PR:H/UI:N rates this 8.6 because exploitation is network-reachable with no user interaction and yields total confidentiality, integrity, and availability impact (VC:H/VI:H/VA:H), but the PR:H requirement - full administrator credentials - is the dominant limiting factor and aligns with SSVC's 'Automatable: no' classification. EPSS of 0.42% (62th percentile) and the absence of a CISA KEV listing both indicate this is not currently a target of mass scanning, consistent with a post-auth admin-only flaw; however, SSVC marks technical impact as 'total' and a working exploit plus Nuclei template are public, so any environment where admin credentials leak, are reused, or are protected only by default/weak passwords should treat this as priority remediation. The realistic risk profile is 'serious for exposed or poorly-credentialed deployments, low for hardened internal installs' - defenders should not dismiss it on the strength of the PR:H alone given how often DMS admin panels end up internet-exposed.

An attacker who has obtained OpenKM administrator credentials - through phishing, password reuse, an exposed default install, or credential stuffing against an internet-facing instance - sends an authenticated POST to /admin/Scripting with action=Evaluate and a BeanShell payload such as Runtime.getRuntime().exec("...") to spawn a reverse shell as the application server user. Because a working Exploit-DB module (52520) and a ready-to-run Nuclei template are publicly available, weaponization requires no original research; from initial shell the attacker can read or exfiltrate the entire document repository, tamper with stored files, and pivot into the underlying database or host network.