CVE-2021-3312

An XML external entity (XXE) vulnerability in Alkacon OpenCms 11.0, 11.0.1 and 11.0.2 allows remote authenticated users with edit privileges to exfiltrate files from the server's file system by uploading a crafted SVG document.

• CWE-611

• https://github.com/alkacon/opencms-core/issues/725Exploit, Issue Tracking, Third Party Advisory
• https://github.com/alkacon/opencms-core/releasesRelease Notes, Third Party Advisory
• https://github.com/alkacon/opencms-core/issues/725Exploit, Issue Tracking, Third Party Advisory
• https://github.com/alkacon/opencms-core/releasesRelease Notes, Third Party Advisory

Published

Oct 8, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-33114Improper input validation for some Intel(R) PROSet/Wireless …5.7
• CVE-2021-33115Improper input validation for some Intel(R) PROSet/Wireless …8.8
• CVE-2021-33116Rejected reason: This is unused.
• CVE-2021-33117Improper access control for some 3rd Generation Intel(R) Xeo…5.5
• CVE-2021-33118Improper access control in the software installer for the In…7.8
• CVE-2021-33119Improper access control in the Intel(R) RealSense(TM) DCM be…5.5
• CVE-2021-33120Out of bounds read under complex microarchitectural conditio…5.4
• CVE-2021-33121Rejected reason: This is unused.
• CVE-2021-33122Insufficient control flow management in the BIOS firmware fo…7.8
• CVE-2021-33123Improper access control in the BIOS authenticated code modul…7.8
• CVE-2021-33124Out-of-bounds write in the BIOS authenticated code module fo…6.7
• CVE-2021-33125Rejected reason: This is unused.