CVE-2026-94109: openEQUELLA < 2026.1.0 Authenticated Stored SSTI via FreemarkerPortletRenderer
openEQUELLA before 2026.1.0 contains an authenticated stored server-side template injection vulnerability in FreemarkerPortletRenderer.renderHtml() that allows any authenticated non-guest user to achieve remote code execution by storing a malicious FreeMarker payload through a POST request to the RemotePortletService invoker endpoint. The markup field from stored portlet configuration is passed directly to custFactory.createResult() without a TemplateClassResolver restriction or FreeMarker sandboxing in BasicConfiguration, leaving built-ins such as ?new and freemarker.template.utility.Execute available, causing the payload to execute in the application server process context when any user renders a dashboard containing the affected portlet.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openEQUELLAto a version that resolves this vulnerability.Fixed in 2026.1.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated openEQUELLA user can exploit it. The attack vector is network-accessible and requires no user interaction, but it does require low-level privileges.
Which application features can carry the malicious input?
Malicious FreeMarker expressions can be injected through collection summaries, dashboard portlets, or MIME templates.
What level of access can successful exploitation provide?
Successful exploitation allows arbitrary command execution through dangerous FreeMarker classes and Runtime.exec. The listed impact includes high confidentiality, integrity, and availability impact.
What version resolves the vulnerability?
The issue affects openEQUELLA versions before 2026.1.0. Upgrade to version 2026.1.0 or later.