CVE-2026-66088: Unrestricted Command Execution via system.execute
In openEQUELLA before 2026.1, the system.execute() function available to the scripting engine runs supplied operating system commands without validation or an allow-list of permitted executables. A user able to create or edit scripts can use it to execute arbitrary commands with the privileges of the openEQUELLA service account.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openEQUELLAto a version that resolves this vulnerability.Fixed in 2026.1
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs the ability to create or edit scripts in the openEQUELLA scripting engine. The resulting commands run with the privileges of the openEQUELLA service account.
Which deployments are affected?
openEQUELLA versions before 2026.1 are affected. The available information does not state whether script creation or editing is enabled by default.
What should be prioritized if an immediate upgrade is not possible?
Restrict the ability to create or edit scripts to only trusted administrators, since that access is required to invoke arbitrary operating system commands through system.execute().