CVE-2026-66090 openEQUELLA - XML External Entity Injection

openEQUELLA < 2026.1 contains an XML external entity injection caused by enabled external entity resolution in the XML parser for item metadata, letting users with CREATE_ITEM permission read arbitrary files or perform SSRF, exploit requires CREATE_ITEM permission.

CVSS base score 7.1 /10
High
CISA KEV
Not listed
Public exploit
None known
Authentication
Required
View the NVD record ↗

Details

Type
XML External Entity Injection
Impact
File System Read, Server Side Request Forgery
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Published
29 October 2026
Updated
29 October 2026
Weakness
CWE-611

Vendor fix

Update to version 2026.1 or later.

Patching closes this CVE. It does not tell you which of your systems run the affected version, or what else is exposed alongside them.

References

← All CVEs