MEDIUM 6.1 NVD
CVE-2026-66089
In openEQUELLA before 2026.1, the SOAP API parses XML supplied in the stopEdit operation with a parser that resolves external entities. This allows an attacker
In openEQUELLA before 2026.1, the SOAP API parses XML supplied in the stopEdit operation with a parser that resolves external entities. This allows an attacker to read arbitrary files accessible to the openEQUELLA service or cause the server to issue requests to attacker-specified locations (SSRF).
References
- https://github.com/openequella/openEQUELLA/security/advisories/GHSA-f9wv-5rpf-rq45
- https://openequella.github.io/guides/
This medium severity vulnerability with a CVSS score of 6.1 was published on 2026-10-29 via NVD.
vulnfeed aggregates 17714 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.