CVE-2026-38429 is a critical XML External Entity (XXE) vulnerability affecting OpenCMS version 20 and earlier. The vulnerability exists in the Admin Import DB feature due to insecure parsing of XML data within user-supplied .zip files containing a manifest.xml. Exploitation could lead to disclosure of sensitive information, system compromise, or denial of service. The CVSS v3.1 base score is 9.8, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official remediation level has been disclosed, and the product is not a cloud service, so remediation depends on vendor updates or user mitigation.

Successful exploitation of this XXE vulnerability can lead to full compromise of the affected system, including unauthorized disclosure of sensitive data, modification of system data, and denial of service. The critical CVSS score (9.8) reflects the potential for complete system takeover without requiring authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, avoid importing untrusted .zip files containing XML data into the Admin Import DB feature. Implement network-level protections to restrict access to the administrative interface and consider disabling the vulnerable feature if feasible.