In openEQUELLA before 2026.1, the pre-login notice image upload endpoint (PUT /api/preloginnotice/image/{name}) does not validate the type of uploaded...
Affected packages
| Ecosystem | Package | Affected | Fixed |
|---|---|---|---|
| Apereo Foundation | openEQUELLA |
≥ 2019.1, < 2026.1 |
2026.1 |
Original description The description as published by the source.
In openEQUELLA before 2026.1, the pre-login notice image upload endpoint (PUT /api/preloginnotice/image/{name}) does not validate the type of uploaded files and serves them with a Content-Type derived from the supplied filename. A user holding the EDIT_SYSTEM_SETTINGS permission can upload an HTML file that is then served as text/html from the openEQUELLA origin, resulting in stored cross-site scripting. Unauthenticated exploitation is possible where EDIT_SYSTEM_SETTINGS has been granted to the guest user or everyone.
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
References
- advisory github.com
- web openequella.github.io
- web nvd.nist.gov
- web openequella.github.io
- web github.com