CVE-2026-42425

High

Description

OpenKM 6.3.12 contains an unrestricted SQL execution vulnerability that allows authenticated administrative users to execute arbitrary SQL statements against the application database via the DatabaseQuery interface. Attackers can submit malicious SQL queries through the qs parameter to the /admin/DatabaseQuery endpoint to extract sensitive data including usernames and password hashes from the OKM_USER table, modify permissions, or delete database records.

SeverityHigh

CVSS7.2

Exploit probability—

ProductOpenKM Community Edition

PublishedMay 26, 2026

First seenMay 26, 2026

Weakness typeCWE-89SQL injection

How to fix

Vendor advisories

terrasystemlabs.com/post?slug=openkm-zero-day-vulnerabilities-terra-system-labs

Affected products

Product	Affected versions	Fixed in
Openkm OpenKM Community Edition	v ≤ 6.3.12	—
Openkm OpenKM Professional Edition	v ≤ 7.1.47	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.