CVE-2019-13237: Local File Inclusion in Alkacon OpenCms
Summary
CVE-2019-13237: Local file inclusion allows unauthorized access to internal resources in Alkacon OpenCms. Affects org.opencms:opencms-core versions < 11.0.1. Fixed in 11.0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Alkacon OpenCms is an open-source content management system (CMS) that allows users to create and manage websites. It is built on top of the Java-based Apache Tomcat server and provides a range of features for content authoring, publishing, and administration. However, versions 10.5.4 and 10.5.5 of Alkacon OpenCms are vulnerable to a Local File Inclusion (LFI) attack.
Vulnerability Detail
The LFI vulnerability in Alkacon OpenCms allows an attacker to access internal server resources by exploiting multiple vulnerable resources, including clearhistory.jsp, convertxml.jsp, group_new.jsp, loginmessage.jsp, xmlcontentrepair.jsp, and /system/workplace/admin/history/settings/index.jsp. By manipulating input parameters, an attacker can traverse the file system and read sensitive files, potentially leading to unauthorized access or information disclosure.
How To Fix
Latest published version: 22.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
11.0.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the official patch or upgrade to a fixed version of Alkacon OpenCms to mitigate the risk.
Conclusion
The Local File Inclusion vulnerability in Alkacon OpenCms versions 10.5.4 and 10.5.5 can allow unauthorized access to internal server resources. To mitigate this risk, it is recommended to upgrade to Alkacon OpenCms version 11.0.1 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.opencms:opencms-core →
FAQ
Alkacon OpenCms is an open-source content management system (CMS) used for creating and managing websites.
Local File Inclusion (LFI) is a vulnerability that allows an attacker to include files from the local file system of a server. By exploiting LFI, an attacker can read sensitive files or execute arbitrary code.
The LFI vulnerability in Alkacon OpenCms can lead to unauthorized access to internal server resources and information disclosure. An attacker could potentially read sensitive files, such as configuration files or user credentials.
Yes, the vulnerability has been fixed in Alkacon OpenCms version 11.0.1 and later. It is recommended to upgrade to the latest stable release to ensure the vulnerability is patched.
No, there is no known workaround for this vulnerability. It is crucial to apply the official patch or upgrade to a fixed version of Alkacon OpenCms.
Related vulnerabilities
Recent vulnerabilities recorded for org.opencms:opencms-core.
