GHSA-668q-3hpr-6c96: SSRF

Published Oct 29, 2026

Updated

In openEQUELLA before 2026.1, the XML parser used for item metadata does not disable external entity resolution. A user permitted to create items (CREATEITEM) can submit crafted XML to POST /api/item and cause the server to read arbitrary files accessible to the openEQUELLA service, or make requests to attacker-specified locations (SSRF), including cloud instance metadata services.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade openEQUELLA to a version that resolves this vulnerability.
Fixed in 2026.1

Frequently Asked Questions

Which users should be considered capable of exploiting this issue?

Exploitation requires a user account with the CREATE_ITEM permission. The issue is not described as requiring user interaction or complex attack conditions beyond submitting crafted XML.

How can teams determine whether an instance is affected?

Instances running openEQUELLA versions before 2026.1 are affected. The relevant API path is POST /api/item, so deployments that allow CREATE_ITEM users to submit item metadata through that endpoint should be prioritized.

What resources could an attacker reach through a successful exploit?

An attacker can cause the openEQUELLA server to read files accessible to the openEQUELLA service account or make server-side requests to attacker-chosen locations. This includes cloud instance metadata services where the server can reach them.

GHSA-668q-3hpr-6c96: SSRF

Remediation

Frequently Asked Questions

Which users should be considered capable of exploiting this issue?

How can teams determine whether an instance is affected?

What resources could an attacker reach through a successful exploit?

Company

Resources

Contact

Frequently Asked Questions

Which users should be considered capable of exploiting this issue?

How can teams determine whether an instance is affected?

What resources could an attacker reach through a successful exploit?