# CVE-2026-41917 - OpenKM 6.3.12 authenticated LFI in the admin scripting interface. The
# /admin/Scripting endpoint with action=Load reads an arbitrary filesystem path supplied in
# the fsPath parameter (e.g. /etc/passwd, config files, JVM keystores). Detect the request
# combining the Scripting endpoint with action=Load and the fsPath parameter.
alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"VEDAS CVE-2026-41917 OpenKM Admin Scripting LFI (fsPath)"; flow:established,to_server; http.uri; content:"/admin/Scripting"; fast_pattern; content:"fsPath="; nocase; content:"action=Load"; nocase; classtype:web-application-attack; reference:cve,CVE-2026-41917; reference:url,https://www.exploit.observer/?keyword=CVE-2026-41917&match=exact; reference:url,https://subdomain.center/?engine=ammonites&keyword=openkm&match=exact; sid:1100005; rev:1;)