CVE-2022-3969 OpenKM FileUtils.java getFileExtension temp file

Low 2.6 Published 13 Nov 2022 Updated 15 Apr 2025

Insecure temporary file handling in OpenKM allows attackers to read or modify data via the getFileExtension function.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-3969?

CVE-2022-3969 is a low-severity vulnerability in unspecified OpenKM, published on 13 Nov 2022. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A vulnerability was found in OpenKM up to 6.3.11 and classified as problematic. Affected by this issue is the function getFileExtension of the file src/main/java/com/openkm/util/FileUtils.java. The manipulation leads to insecure temporary file. Upgrading to version 6.3.12 is able to address this issue. The name of the patch is c069e4d73ab8864345c25119d8459495f45453e1. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-213548.

Weakness: CWE-377

Which versions are affected by CVE-2022-3969?

It affects 1 product.

Products include Openkm Openkm.

How do I fix CVE-2022-3969?

No fix has been published for CVE-2022-3969 yet. Limit exposure of the affected software until one is available.

Is CVE-2022-3969 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-3969 exists.

Sources

Also known as GHSA-ggj7-q25m-33xx.