PT-2026-37087 · Opencms · Opencms

Westenberger · Published 2026-05-05 · Updated 2026-05-12 · CVE-2026-38429

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenCMS versions prior to 21

Description The Admin Import DB feature is susceptible to XML External Entity (XXE), a flaw where an application processes XML input containing a reference to an external entity, potentially allowing unauthorized access to files or internal systems. This occurs due to insecure XML parsing of user-supplied .zip files that contain a manifest.xml file.

Recommendations Update to a version later than v20. As a temporary workaround, restrict the use of the Admin Import DB feature or avoid importing .zip files from untrusted sources.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2026-38429

Affected Products

Opencms

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-38429 · Security Note
• https://github.com/alkacon/opencms-core/commit/e3e41e5a96d71383279e7d23c627efc9934008c1 · Note
• https://twitter.com/CVEnew/status/2051741666722095605 · Twitter Post
• https://twitter.com/lyrie_ai/status/2054148754102423942 · Twitter Post
• https://twitter.com/infoflowcloud/status/2051742907560820925 · Twitter Post
• https://twitter.com/lyrie_ai/status/2054148755872518627 · Twitter Post
• https://t.me/CVEtracker/52773 · Telegram Post
• https://twitter.com/lyrie_ai/status/2054148754995843141 · Twitter Post