CVE-2026-94109highCWE-1336

CVE-2026-94109: high-severity vulnerability in openEQUELLA

openEQUELLA < 2026.1.0 Authenticated Stored SSTI via FreemarkerPortletRenderer

Published · Updated

Follow this CVE+ Monitor openEQUELLA

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

41Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 8.6epss 0.8%
openEQUELLA before 2026.1.0 contains an authenticated stored server-side template injection vulnerability in FreemarkerPortletRenderer.renderHtml() that allows any authenticated non-guest user to achieve remote code execution by storing a malicious FreeMarker payload through a POST request to the RemotePortletService invoker endpoint. The markup field from stored portlet configuration is passed directly to custFactory.createResult() without a TemplateClassResolver restriction or FreeMarker sandboxing in BasicConfiguration, leaving built-ins such as ?new and freemarker.template.utility.Execute available, causing the payload to execute in the application server process context when any user renders a dashboard containing the affected portlet.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
openequella · openEQUELLA
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.