{"id":"CVE-2026-38429","details":"OpenCMS v20 and before is vulnerable to XML External Entity (XXE) in the Admin Import DB feature due to insecure XML parsing of user supplied .zip files containing a manifest.xml.","modified":"2026-07-27T09:24:29.993866Z","published":"2026-05-05T00:00:00Z","database_specific":{"cna_assigner":"mitre","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/38xxx/CVE-2026-38429.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/38xxx/CVE-2026-38429.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-38429"},{"type":"FIX","url":"https://github.com/alkacon/opencms-core/commit/e3e41e5a96d71383279e7d23c627efc9934008c1"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/alkacon/opencms-core","events":[{"introduced":"0"},{"fixed":"e3e41e5a96d71383279e7d23c627efc9934008c1"}],"database_specific":{"source":"REFERENCES"}}],"versions":["build_20_0_0","build_19_0_0","build_18_0_0","build_17_0_0","build_16_0_0","build_15_0_0","build_14_0_0","build_13_0_0","build_12_0_0","build_11_0_0_rc","build_11_0_0_beta_2","build_11_0_0_beta","build_10_5_0_3","build_10_5_0_2","build_10_5_0_1","build_10_5_0","build_10_5_0_beta","build_10_5_x_cmsdays","build_10_0_0","build_10_0_0_beta4","build_10_0_0_beta3","build_10_0_0_beta_2","build_10_0_0_beta","build_10_0_0_alpha_2","build_10_0_0_alpha_1u","build_10_0_0_alpha_1","build_9_5_0","build_9_0_0_1","build_9_0_0","build_8_9_0","build_8_7_0","build_8_5_1","build_8_5_0","build_8_0_3","build_8_0_2","build_8_0_2_1","build_8_0_1","build_8_0_0","build_7_9_2","build_7_5_0_beta_1","build_7_3_0","build_7_0_4","build_7_0_2","build_7_0_1","build_7_0_0","build_6_2_3","build_6_2_2","build_6_2_1","build_6_2_0","build_6_1_13","build_6_0_5","build_6_0_4","build_6_0_3","build_6_0_2","build_6_0_1","build_6_0_0","build_5_9_2","build_5_9_1","build_5_7_3","build_5_7_2","build_5_7_1","build_5_5_4","build_5_5_3","build_5_5_2","build_5_5_1","build_5_3_6","build_5_3_5","build_5_3_4","build_5_3_3","build_5_3_1","build_5_1_12","build_5_1_11","build_5_1_10","build_5_1_9","build_5_1_8","build_5_1_7","build_5_1_6","build_5_1_5","build_5_1_4","build_5_1_3","build_5_1_1","build_5_0_0","build_5_1_0","build_5_0_0_rc_2","build_5_0_0_rc_1","build_5_0_0_beta_2","build_4_7_14","build_5_0_0_beta_1","build_4_7_13","build_4_7_12","build_4_7_11","build_4_7_10","build_4_7_9","build_4_7_8","build_4_7_6"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-38429.json","vanir_signatures_modified":"2026-07-27T09:24:29Z","vanir_signatures":[{"digest":{"function_hash":"150378459566197607171381904126069760216","length":1018},"id":"CVE-2026-38429-0f1d98a8","signature_type":"Function","signature_version":"v1","source":"https://github.com/alkacon/opencms-core/commit/e3e41e5a96d71383279e7d23c627efc9934008c1","target":{"function":"importData","file":"src/org/opencms/importexport/CmsImportVersion3.java"},"deprecated":false},{"id":"CVE-2026-38429-2aca5ce8","signature_type":"Line","signature_version":"v1","source":"https://github.com/alkacon/opencms-core/commit/e3e41e5a96d71383279e7d23c627efc9934008c1","target":{"file":"src/org/opencms/importexport/CmsXmlPageConverter.java"},"deprecated":false,"digest":{"line_hashes":["145574074109000369493955727831983032494","16640040146647270071345503687484714308","169192263732467465202538910163828443427","85988428784867084438144774304856970190","318210125088655057575942019883947184609","59071069497845359753083566457126727257","247471594557108826914438128328516223540","240140326639279127449893358793276776823"],"threshold":0.9}},{"target":{"file":"src/org/opencms/importexport/CmsImportVersion5.java","function":"importData"},"deprecated":false,"digest":{"function_hash":"164464879669006136806220302618854857961","length":1194},"id":"CVE-2026-38429-53319ecd","signature_type":"Function","signature_version":"v1","source":"https://github.com/alkacon/opencms-core/commit/e3e41e5a96d71383279e7d23c627efc9934008c1"},{"source":"https://github.com/alkacon/opencms-core/commit/e3e41e5a96d71383279e7d23c627efc9934008c1","target":{"file":"src/org/opencms/importexport/CmsImportVersion4.java","function":"importData"},"deprecated":false,"digest":{"function_hash":"323481953919937463736669170940028725469","length":1078},"id":"CVE-2026-38429-655efb6b","signature_type":"Function","signature_version":"v1"},{"target":{"file":"src/org/opencms/importexport/CmsImportVersion5.java"},"deprecated":false,"digest":{"line_hashes":["181059242248379036739186949021608391390","147973670601283964574541985247054292952","221415849426066096990887051712425454553","337459723314667745362475205776367896967","181556868906426691666909733990579306215","278037913868309246698932749035067939230","205811112067745696225392953192930172056","175564781610366784375673727899214416576","495030207641427856478257289104084366","205753641410184498495949857856575525299","73224307637468384163576952728336865551","243102776978891516393007945551500994531","39021436506914960625336438103559301269","9382823883554512336715172214757885066","20243658841510529412945612926541096186","185283445785534008380812332815806960562","308407306302046910333601346883091611005","72556814150170722067127042214809249759","43814319413669785550600424258384575863"],"threshold":0.9},"id":"CVE-2026-38429-656b583f","signature_type":"Line","signature_version":"v1","source":"https://github.com/alkacon/opencms-core/commit/e3e41e5a96d71383279e7d23c627efc9934008c1"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["181059242248379036739186949021608391390","147973670601283964574541985247054292952","221415849426066096990887051712425454553","337459723314667745362475205776367896967","181556868906426691666909733990579306215","278037913868309246698932749035067939230","205811112067745696225392953192930172056","175564781610366784375673727899214416576","270064422986870007225845663921307750895","205753641410184498495949857856575525299","73224307637468384163576952728336865551","243102776978891516393007945551500994531","39021436506914960625336438103559301269","9382823883554512336715172214757885066","20243658841510529412945612926541096186","185283445785534008380812332815806960562","75611659833126041066799616841059377336","250505799595875241910171462188818615271","215408660540593556582947204667459396371"]},"id":"CVE-2026-38429-6d418702","signature_type":"Line","signature_version":"v1","source":"https://github.com/alkacon/opencms-core/commit/e3e41e5a96d71383279e7d23c627efc9934008c1","target":{"file":"src/org/opencms/importexport/CmsImportVersion4.java"}},{"id":"CVE-2026-38429-834c5d8e","signature_type":"Function","signature_version":"v1","source":"https://github.com/alkacon/opencms-core/commit/e3e41e5a96d71383279e7d23c627efc9934008c1","target":{"file":"src/org/opencms/importexport/CmsImportVersion2.java","function":"importData"},"deprecated":false,"digest":{"function_hash":"12226235277250738998025490039307120906","length":1637}},{"target":{"file":"src/org/opencms/importexport/CmsImportVersion2.java","function":"mergePageFile"},"deprecated":false,"digest":{"function_hash":"120894723339182231600175419956008544586","length":4956},"id":"CVE-2026-38429-bec2b405","signature_type":"Function","signature_version":"v1","source":"https://github.com/alkacon/opencms-core/commit/e3e41e5a96d71383279e7d23c627efc9934008c1"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["279804039993241807417941060248349660326","56744153475790451898074080963054278278","249466267802660174160066781099542776146","331924858928345494486341486605572166778","181556868906426691666909733990579306215","278037913868309246698932749035067939230","205811112067745696225392953192930172056","175564781610366784375673727899214416576","289360280611485728570254877855436204843","295790348673944489166275768873937990543","298793317334150000321843208433361217181","15762109856477001922803046846564678650"]},"id":"CVE-2026-38429-cec32557","signature_type":"Line","signature_version":"v1","source":"https://github.com/alkacon/opencms-core/commit/e3e41e5a96d71383279e7d23c627efc9934008c1","target":{"file":"src/org/opencms/importexport/CmsImportVersion2.java"}},{"source":"https://github.com/alkacon/opencms-core/commit/e3e41e5a96d71383279e7d23c627efc9934008c1","target":{"function":"convertToXmlPage","file":"src/org/opencms/importexport/CmsXmlPageConverter.java"},"deprecated":false,"digest":{"function_hash":"278686140696494030632290966608204747039","length":1697},"id":"CVE-2026-38429-e44620d1","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/alkacon/opencms-core/commit/e3e41e5a96d71383279e7d23c627efc9934008c1","target":{"file":"src/org/opencms/importexport/CmsImportVersion3.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["105917874054993401105767442443425640210","84783280077536608044989516684238732562","168855807753060455629373850837136089259","331924858928345494486341486605572166778","181556868906426691666909733990579306215","278037913868309246698932749035067939230","205811112067745696225392953192930172056","175564781610366784375673727899214416576"]},"id":"CVE-2026-38429-fa70a33c","signature_type":"Line"}]}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}