CVE-2026-66090: fallo de gravedad alta en Apereo Foundation openEQUELLA
XML External Entity (XXE) Injection in Metadata Field Allows Arbitrary File Read
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7.1epss 0.3%
In openEQUELLA before 2026.1, the XML parser used for item metadata does not disable external entity resolution. A user permitted to create items (CREATE_ITEM) can submit crafted XML to POST /api/item and cause the server to read arbitrary files accessible to the openEQUELLA service, or make requests to attacker-specified locations (SSRF), including cloud instance metadata services.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N
Productos afectados
Apereo Foundation · openEQUELLACVEs relacionadas — Apereo Foundation openEQUELLA
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-66088CRITICALUnrestricted Command Execution via system.executeEPSS 0.7%CVE-2026-67615HIGHopenEQUELLA < 2026.1.0 Authenticated RCE via Java Deserialization in HTTP InvokerEPSS 0.5%CVE-2026-66091MEDIUMUnauthenticated IDOR Enables Disclosure of Other Users’ last-known detailsEPSS 0.4%CVE-2026-66092MEDIUMStored XSS in pre-login notice via reachable legacy logon routeEPSS 0.3%CVE-2026-16889MEDIUMStored XSS via Pre-Login Notice Image Upload Serves Attacker HTML from Application OriginEPSS 0.3%CVE-2026-66089MEDIUMXML External Entity (XXE) Vulnerability in SOAP Interface Allows External Entity ExpansionEPSS 0.3%