CVE-2026-38429 identifies an XXE vulnerability in OpenCMS v20 and prior versions within the Admin Import DB functionality. The issue stems from insecure handling of XML data in .zip files containing a manifest.xml, allowing potential XML External Entity attacks. No CVSS score or detailed exploit information is available. The vulnerability is published but no official patch or remediation guidance has been provided by the vendor.

The vulnerability could allow an attacker to exploit XML External Entity processing, potentially leading to disclosure of sensitive information or other impacts typical of XXE flaws. However, no specific impact details or exploitation reports are available. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting or monitoring the use of the Admin Import DB feature with untrusted .zip files containing XML data to reduce risk.