CVE-2026-66090: XML External Entity (XXE) Injection in Metadata Field Allows Arbitrary File Read
In openEQUELLA before 2026.1, the XML parser used for item metadata does not disable external entity resolution. A user permitted to create items (CREATEITEM) can submit crafted XML to POST /api/item and cause the server to read arbitrary files accessible to the openEQUELLA service, or make requests to attacker-specified locations (SSRF), including cloud instance metadata services.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openEQUELLAto a version that resolves this vulnerability.Fixed in 2026.1
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user with the CREATE_ITEM permission can exploit it by submitting crafted XML to the POST /api/item endpoint.
What systems or data could be exposed?
The issue can read arbitrary files that are accessible to the openEQUELLA service. It can also make server-side requests to attacker-chosen locations, including cloud instance metadata services.
Which versions are affected?
openEQUELLA versions before 2026.1 are affected.