{"action":"Upgrade org.opencms:opencms-core to 16.0 or later.","affected":[{"fixed":"16.0","introduced":"0"}],"component":"org.opencms:opencms-core","cve_ids":["CVE-2023-42346"],"ecosystem":"Maven","epss":0.00232,"exploited":false,"fixed_versions":["16.0"],"ghsa_id":"GHSA-pj6p-9p8x-5mfc","id":"tcs_01M5N97M4N6BFJ7TH4HR0KTVBS","modified_at":"2026-05-14T13:26:35.749354Z","published_at":"2026-05-08T06:32:37Z","references":["https://osv.dev/vulnerability/GHSA-pj6p-9p8x-5mfc","https://nvd.nist.gov/vuln/detail/CVE-2023-42346","https://github.com/alkacon/opencms-core","https://labs.watchtowr.com/xxe-you-can-depend-on-me-opencms"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-pj6p-9p8x-5mfc","url":"https://osv.dev/vulnerability/GHSA-pj6p-9p8x-5mfc"}],"summary":"Alkacon OpenCms is vulnerable to XXE when the <!DOCTYPE> refers to an external host"}