Description
OpenCMS v20 and before is vulnerable to XML External Entity (XXE) in the Admin Import DB feature due to insecure XML parsing of user supplied .zip files containing a manifest.xml.
Critical · 9.8
CVE-2026-38429
EUVD-2026-27401GHSA-r362-p5vx-pj8p
OpenCMS v20 and before is vulnerable to XML External Entity (XXE) in the Admin Import DB feature due to insecure XML parsing of user suppli…
Published May 5, 2026 · Updated May 6, 2026 · Assigned by mitre