CVE-2026-41917

OpenKM 6.3.12 is affected by a local file inclusion (LFI) in the administrative scripting interface at /admin/Scripting. An authenticated administrator can trigger action=Load with a user-supplied fsPath to read arbitrary files, including /etc/passwd, configuration files containing database crede...

CVE-2026-41917 OpenKM 6.3.12 Local File Inclusion via Admin Scripting

OpenKM 6.3.12 contains a local file inclusion vulnerability in the administrative scripting interface at /admin/Scripting that allows authenticated administrators to read arbitrary files by supplying an attacker-controlled filesystem path through the fsPath parameter with action=Load. Attackers c...

PT-2026-43253

OpenKM 6.3.12 contains a local file inclusion vulnerability in the administrative scripting interface at /admin/Scripting that allows authenticated administrators to read arbitrary files by supplying an attacker-controlled filesystem path through the fsPath parameter with action=Load. Attackers c...