openEQUELLA vulnerabilities
3 known vulnerabilities in openEQUELLA from Apereo Foundation. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.1 High severity
openEQUELLA: Improper Restriction of XML External Entity Reference
In openEQUELLA before 2026.1, the XML parser used for item metadata does not disable external entity resolution. A user permitted to create items (CREATE_ITEM) can submit crafted XML to POST /api/item and cause the server to read arbitrary files accessible to
- 9.4 Critical severity
openEQUELLA: Improper Neutralization of Special Elements used in an OS Command
In openEQUELLA before 2026.1, the system.execute() function available to the scripting engine runs supplied operating system commands without validation or an allow-list of permitted executables. A user able to create or edit scripts can use it to execute arbi
- 8.8 High severity
openEQUELLA: Incomplete List of Disallowed Inputs
openEQUELLA before 2026.1.0 contains an authenticated remote code execution vulnerability that allows any authenticated non-guest user to execute arbitrary code by exploiting Java deserialization in the HTTP invoker endpoint at /invoker/*. Attackers can bypass