Medium severityNVD Advisory· Published Oct 29, 2026

CVE-2026-66089

Description

In openEQUELLA before 2026.1, the SOAP API parses XML supplied in the stopEdit operation with a parser that resolves external entities. This allows an attacker to read arbitrary files accessible to the openEQUELLA service or cause the server to issue requests to attacker-specified locations (SSRF).

Patches

Vulnerability mechanics

References

github.com/openequella/openEQUELLA/security/advisories/GHSA-f9wv-5rpf-rq45nvd
openequella.github.io/guides/nvd

News mentions

No linked articles in our index yet.