CVE-2026-16889: fallo de gravedad media en Apereo Foundation openEQUELLA
Stored XSS via Pre-Login Notice Image Upload Serves Attacker HTML from Application Origin
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 4.8epss 0.3%
In openEQUELLA before 2026.1, the pre-login notice image upload endpoint (PUT /api/preloginnotice/image/{name}) does not validate the type of uploaded files and serves them with a Content-Type derived from the supplied filename. A user holding the EDIT_SYSTEM_SETTINGS permission can upload an HTML file that is then served as text/html from the openEQUELLA origin, resulting in stored cross-site scripting. Unauthenticated exploitation is possible where EDIT_SYSTEM_SETTINGS has been granted to the guest user or everyone.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Productos afectados
Apereo Foundation · openEQUELLACVEs relacionadas — Apereo Foundation openEQUELLA
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-66088CRITICALUnrestricted Command Execution via system.executeEPSS 0.7%CVE-2026-67615HIGHopenEQUELLA < 2026.1.0 Authenticated RCE via Java Deserialization in HTTP InvokerEPSS 0.5%CVE-2026-66091MEDIUMUnauthenticated IDOR Enables Disclosure of Other Users’ last-known detailsEPSS 0.4%CVE-2026-66092MEDIUMStored XSS in pre-login notice via reachable legacy logon routeEPSS 0.3%CVE-2026-66090HIGHXML External Entity (XXE) Injection in Metadata Field Allows Arbitrary File ReadEPSS 0.3%CVE-2026-66089MEDIUMXML External Entity (XXE) Vulnerability in SOAP Interface Allows External Entity ExpansionEPSS 0.3%