CVE-2026-16889: Stored XSS via Pre-Login Notice Image Upload Serves Attacker HTML from Application Origin
In openEQUELLA before 2026.1, the pre-login notice image upload endpoint (PUT /api/preloginnotice/image/{name}) does not validate the type of uploaded files and serves them with a Content-Type derived from the supplied filename. A user holding the EDITSYSTEMSETTINGS permission can upload an HTML file that is then served as text/html from the openEQUELLA origin, resulting in stored cross-site scripting. Unauthenticated exploitation is possible where EDITSYSTEMSETTINGS has been granted to the guest user or everyone.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker needs the EDIT_SYSTEM_SETTINGS permission to upload a file through the pre-login notice image endpoint. Exploitation can be unauthenticated if that permission has been granted to the guest user or everyone.
Which deployments are affected?
openEQUELLA versions before 2026.1 are affected. Deployments are exposed when a principal with EDIT_SYSTEM_SETTINGS can upload a filename that causes the content to be served as HTML from the application origin.
How can I determine whether unauthenticated users are exposed?
Review whether the guest user or everyone has been granted EDIT_SYSTEM_SETTINGS. If either does, an unauthenticated user can use the upload endpoint to store attacker-controlled HTML.