Read the docs
TI-2022-03638 Aliases CVE-2022-3969GHSA-ggj7-q25m-33xx

OpenKM FileUtils.java getFileExtension temp file

Priority MEDIUM 58CWE-377Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

A vulnerability was found in OpenKM up to 6.3.11 and classified as problematic. Affected by this issue is the function getFileExtension of the file src/main/java/com/openkm/util/FileUtils.java. The manipulation leads to insecure temporary file. Upgrading to version 6.3.12 is able to address this issue. The name of the patch is c069e4d73ab8864345c25119d8459495f45453e1. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-213548.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00551 46th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
unspecifiedOpenKM6.3.0; 6.3.1; 6.3.2; 6.3.3; 6.3.4; 6.3.5; 6.3.6; 6.3.7; 6.3.8; 6.3.9; 6.3.10; 6.3.11—No fix listedCNA
  • OpenKM Vendorunspecified Affected 6.3.0; 6.3.1; 6.3.2; 6.3.3; 6.3.4; 6.3.5; 6.3.6; 6.3.7; 6.3.8; 6.3.9; 6.3.10; 6.3.11 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:openkm:openkm:*:*:*:*:*:*:*:*before 6.3.12VulnerableOpenKM
  • cpe:2.3:a:openkm:openkm:*:*:*:*:*:*:*:* Versions before 6.3.12 Vulnerable ·OpenKM

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-3969
  2. 2026-10-03 Alias added: GHSA-ggj7-q25m-33xx

References

Exploit 1

Patch 1

Advisory 1

  • TI-2025-35487 OpenKM Community Edition 6.3.12 is vulnerable to stored cross-site scripting (XSS) in the… CVSS 3.1MEDIUM 5.4
  • TI-2023-27378 A Stored Cross-Site Scripting (XSS) vulnerability exists in OpenKM version 7.1.40… CVSS 3.1MEDIUM 5.4
  • TI-2022-23491 Cross-site scripting in OpenKM CVSS 3.1MEDIUM 5.4
  • TI-2022-23490 Cross-site scripting in OpenKM CVSS 3.1MEDIUM 5.4
  • TI-2019-08541 OpenKM 6.3.2 through 6.3.7 allows an attacker to upload a malicious JSP file into the… CVSS 3.0HIGH 7.2
  • TI-2022-01972 OpenKM XXE Injection CVSS 3.1CRITICAL 9.8
See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences