Read the docs
TI-2021-02316 Aliases CVE-2021-3312GHSA-g6v7-vqhx-6v6c

An XML external entity (XXE) vulnerability in Alkacon OpenCms 11.0, 11.0.1 and 11.0.2…

Priority LOW 31CWE-611Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-611 and the CVSS impact.

Summary

An XML external entity (XXE) vulnerability in Alkacon OpenCms 11.0, 11.0.1 and 11.0.2 allows remote authenticated users with edit privileges to exfiltrate files from the server's file system by uploading a crafted SVG document.

Why it matters now

EPSS 0.0129 70th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed org.opencms:opencms-core (Maven): 12.0.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—org.opencms:opencms-core (Maven)11.0.0 to before 12.0.012.0.0Patch availableGHSA-g6v7-vqhx-6v6c
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • org.opencms:opencms-core (Maven) Vendor— Affected 11.0.0 to before 12.0.0 Fixed in 12.0.0 Patch available GHSA-g6v7-vqhx-6v6c

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:alkacon:opencms:11.0:-:*:*:*:*:*:*11.0VulnerableAlkacon
cpe:2.3:a:alkacon:opencms:11.0.1:*:*:*:*:*:*:*11.0.1VulnerableAlkacon
cpe:2.3:a:alkacon:opencms:11.0.2:*:*:*:*:*:*:*11.0.2VulnerableAlkacon
  • cpe:2.3:a:alkacon:opencms:11.0:-:*:*:*:*:*:* Versions 11.0 Vulnerable ·Alkacon
  • cpe:2.3:a:alkacon:opencms:11.0.1:*:*:*:*:*:*:* Versions 11.0.1 Vulnerable ·Alkacon
  • cpe:2.3:a:alkacon:opencms:11.0.2:*:*:*:*:*:*:* Versions 11.0.2 Vulnerable ·Alkacon

Remediation

  • Fix · GHSA-g6v7-vqhx-6v6c org.opencms:opencms-core (Maven) Fixed in 12.0.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-3312
  2. 2026-10-03 Alias added: GHSA-g6v7-vqhx-6v6c

References

Exploit 1

Advisory 2

Other 3

  • TI-2024-28583 Cross Site Scripting vulnerability in Create/Modify article function in Alkacon OpenCMS… CVSS 3.1MEDIUM 6.5
  • TI-2023-19187 An arbitrary file upload vulnerability in the component /workplace#!explorer of Alkacon… CVSS 3.1MEDIUM 6.1
  • TI-2024-27633 A stored cross-site scripting (XSS) vulnerability in Alkacon OpenCMS v17.0 allows… CVSS 3.1MEDIUM 5.4
  • TI-2024-27632 A stored cross-site scripting (XSS) vulnerability in Alkacon OpenCMS v17.0 allows… CVSS 3.1MEDIUM 5.4
  • TI-2023-15113 A stored cross-site scripting (XSS) vulnerability in alkacon-OpenCMS v11.0.0.0 allows… CVSS 3.1MEDIUM 5.4
  • TI-2021-07974 OpenCMS - Stored Cross-Site Scripting (XSS) in Sitemap CVSS 3.1MEDIUM 5.4
See all 31 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences