CVE-2026-42425 is an SQL injection vulnerability in OpenKM Community Edition 6.3.12 that permits authenticated administrative users to execute arbitrary SQL statements through the qs parameter of the /admin/DatabaseQuery interface. This unrestricted SQL execution can lead to unauthorized data disclosure, modification, or deletion within the application database, including sensitive user credentials stored in the OKM_USER table. The vulnerability requires high privileges (administrative access) and does not require user interaction. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required beyond admin, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an authenticated administrator to execute arbitrary SQL commands on the backend database. This can result in disclosure of sensitive data such as usernames and password hashes, unauthorized modification of permissions, and deletion of database records. The impact affects confidentiality, integrity, and availability of the application data. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrative access to trusted users only and monitor for suspicious activity on the /admin/DatabaseQuery endpoint. Avoid exposing this interface unnecessarily. Follow vendor communications for updates regarding patches or official mitigations.