CVE-2026-66089 in openEQUELLA
Summary
by MITRE • 10/29/2026
In openEQUELLA before 2026.1, the SOAP API parses XML supplied in the stopEdit operation with a parser that resolves external entities. This allows an attacker to read arbitrary files accessible to the openEQUELLA service or cause the server to issue requests to attacker-specified locations (SSRF).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/29/2026
The vulnerability identified in versions of openEQUELLA prior to 2026.1 stems from a critical misconfiguration within its SOAP API implementation, specifically affecting the stopEdit operation. This function is designed to process XML data submitted by clients to finalize editing sessions for content items. However, the underlying XML parser employed by this endpoint fails to disable support for external entity resolution. In standard XML processing, External Entity (XXE) definitions allow documents to reference resources outside of their immediate scope, such as local files on the server or remote URLs. When a parser is configured with default settings that permit these references without adequate sanitization, it becomes possible for an attacker to inject maliciously crafted XML payloads containing entity declarations that point to sensitive internal paths or arbitrary external destinations.
From a technical perspective, this flaw represents a classic instance of Improper Limitation of a Pathname to a Restricted Directory, categorized under CWE-22 in the Common Weakness Enumeration standards. The vulnerability is further classified as an XML External Entity Injection (XXE) attack vector, which aligns with specific techniques observed in adversary behavior models such as those documented by MITRE ATT&CK. By leveraging this weakness, an attacker can manipulate the server's processing logic to perform unintended actions based on the content of the injected entities. The severity of this issue is compounded by its potential for Server-Side Request Forgery (SSRF), where the application acts as a proxy for the attacker, initiating HTTP requests to internal services or external systems that may not be directly accessible from the internet.
The operational impact of exploiting this vulnerability is significant and multifaceted. In the most severe scenario, an authenticated user with permission to use the stopEdit operation can read arbitrary files from the server's file system. This could lead to the exposure of sensitive configuration data, database credentials, source code, or other proprietary information stored in locations accessible by the openEQUELLA service account. Alternatively, if external entity resolution is directed toward network resources, the attacker can force the server to connect to internal endpoints that are otherwise firewalled off from public access. This SSRF capability allows for reconnaissance of the internal network topology and potential exploitation of other vulnerable services running on localhost or within the private subnet, effectively bypassing perimeter security controls.
To mitigate this vulnerability, immediate action is required to update openEQUELLA to version 2026.1 or later, where the XML parser has been hardened against external entity resolution. For organizations unable to patch immediately due to operational constraints, temporary mitigations should be implemented at the infrastructure level. This includes configuring web application firewalls (WAFs) to detect and block SOAP requests containing suspicious XML structures indicative of XXE attacks, such as DOCTYPE declarations with ENTITY definitions. Additionally, ensuring that the openEQUELLA service runs under a restricted user account with minimal file system permissions can limit the scope of data exposure in case of exploitation. Network segmentation should also be reviewed to ensure that internal services are not inadvertently exposed through SSRF attempts originating from the application server.