Medium 6.1

In openEQUELLA before 2026.1, the SOAP API parses XML supplied in the stopEdit operation with a...

CVE-2026-66089 First seen on SecPulse Oct 29, 10:36

Affected packages

Ecosystem	Package	Affected	Fixed
Apereo Foundation	openEQUELLA	< 2026.1	2026.1

Original description The description as published by the source.

In openEQUELLA before 2026.1, the SOAP API parses XML supplied in the stopEdit operation with a parser that resolves external entities. This allows an attacker to read arbitrary files accessible to the openEQUELLA service or cause the server to issue requests to attacker-specified locations (SSRF).

Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory

References

Key facts

CVSS v4: Medium 6.1; CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:L/SC:L/SI:N/SA:N
Published: Oct 29, 2026
First seen on SecPulse: Oct 29, 10:36
GHSA: GHSA-93f7-2j6h-9wwg
CWE: CWE-611

NVD GitHub Advisory

Tags(click for explanation)

Attack Types

Server-Side Request Forgery

CWE

CWE-611

All

Apereo Foundation Openequella

Detection sources

NIST National Vulnerability Database00:56
GitHub Security Advisories (Global)Oct 29, 12:30
CVE.org (CVE Program・cvelistV5)Oct 29, 11:02