Description
Alkacon OpenCms before 16 allows XXE when the <!DOCTYPE> refers to an external host.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.opencms:opencms-core | < 16.0 | 16.0 | GHSA-pj6p-9p8x-5mfc |
High · 7.5
CVE-2023-42346
EUVD-2023-46799GHSA-pj6p-9p8x-5mfc
Alkacon OpenCms is vulnerable to XXE when the <!DOCTYPE> refers to an external host
Published May 8, 2026 · Updated May 11, 2026 · Assigned by mitre