Alkacon OpenCms versions before 16 contain a flaw that processes XML documents containing a DOCTYPE declaration that references an external host. When such XML is submitted to the application, the server resolves the external entity, which allows an attacker to read arbitrary files on the server or retrieve data from arbitrary URLs. This weakness is an XML External Entity (XXE) vulnerability classified as CWE-611, with primary impact the disclosure of confidential information and unauthorized access to server files.

All releases of Alkacon OpenCms earlier than version 16 are susceptible because the default configuration does not disable external entity resolution. Users should verify their installed version and confirm whether external entity processing is enabled. No further version granularity is provided in the CVE entry.

The CVSS score of 7.5 signals a high severity for this flaw, and the EPSS score of < 1% indicates limited real‑world activity to date. If an application endpoint accepts XML input from users, an attacker can supply malicious XML that resolves external entities. The result is uncontrolled file or directory disclosure, potentially leaking sensitive configuration data or other confidential documents. The flaw is not currently listed in CISA’s KEV catalog, but its high severity and remote reach mean that a prompt evaluation and patching is advised.