Skip to content
CVE PROGRAM SOURCE RECORD6.1 Medium

CVE-2026-66089

XML External Entity (XXE) Vulnerability in SOAP Interface Allows External Entity Expansion

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
MON-CSIRT

Description

In openEQUELLA before 2026.1, the SOAP API parses XML supplied in the stopEdit operation with a parser that resolves external entities. This allows an attacker to read arbitrary files accessible to the openEQUELLA service or cause the server to issue requests to attacker-specified locations (SSRF).

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Apereo Foundation openEQUELLA

Default version status: unaffected

  • 0 to < 2026.1affected
  • 2026.1 to ≤ 2026.2unaffected

References