CVE-2026-38429: OpenCMS v20 and before is vulnerable to XML External Entity (XXE) in the Admin Import DB feature due to insecure XML...
CRITICAL
CVSS 9.5
Published: May 5, 2026 | Last Modified: May 5, 2026
Description
OpenCMS v20 and before is vulnerable to XML External Entity (XXE) in the Admin Import DB feature due to insecure XML parsing of user supplied .zip files containing a manifest.xml.
Ghostwire Analysis — What This Means Practically
- Critical CVSS score indicates maximum severity — remote code execution, authentication bypass, or complete system compromise is likely possible.
This analysis is generated by Ghostwire from NVD, CISA KEV, EPSS, and open-source intelligence data. Verify findings through primary sources before acting.
Security Coverage (2 articles)
References