CVE-2026-66090 in openEQUELLA
Summary
by MITRE • 10/29/2026
In openEQUELLA before 2026.1, the XML parser used for item metadata does not disable external entity resolution. A user permitted to create items (CREATE_ITEM) can submit crafted XML to POST /api/item and cause the server to read arbitrary files accessible to the openEQUELLA service, or make requests to attacker-specified locations (SSRF), including cloud instance metadata services.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/29/2026
The vulnerability identified in openEQUELLA versions prior to 2026.1 represents a critical security flaw rooted in the improper configuration of XML parsing mechanisms used for processing item metadata. Specifically, the application fails to disable external entity resolution within its Extensible Markup Language parser. This oversight allows an attacker who possesses the CREATE_ITEM permission to inject maliciously crafted XML payloads into the system via the POST /api/item endpoint. By leveraging this capability, the adversary can exploit the server's ability to resolve and process external entities defined in the submitted document structure.
From a technical perspective, the core issue lies in the lack of sanitization or restriction on entity expansion during the parsing phase. When an XML parser is configured with external entity resolution enabled by default, it will attempt to fetch resources referenced within those entities. In this scenario, an authenticated user can define an entity that points to a local file path or a remote Uniform Resource Locator. The server then processes this request as part of normal metadata ingestion operations, effectively executing the actions dictated by the crafted XML without additional validation checks regarding the source or nature of the external resource being accessed.
The operational impact of this vulnerability is severe and multifaceted. Primarily, it enables Arbitrary File Read attacks, allowing the attacker to access sensitive files on the server's file system that are accessible to the openEQUELLA service account. This could lead to the exfiltration of configuration files containing database credentials, API keys, or other secrets essential for maintaining the integrity and confidentiality of the platform. Furthermore, the vulnerability facilitates Server-Side Request Forgery attacks. By directing the server to make HTTP requests to attacker-specified locations, an adversary can probe internal network services that are not directly exposed to the internet. This is particularly dangerous in cloud environments where it allows access to instance metadata services, such as AWS EC2 Instance Metadata Service or Azure Managed Identity endpoints, potentially leading to full compromise of the underlying infrastructure through credential theft from these metadata APIs.
This vulnerability aligns with Common Weakness Enumeration identifier CWE-611, which describes Improper Restriction of XML External Entity Reference. It also maps closely to MITRE ATT&CK techniques related to Data from Local System and Cloud Infrastructure Discovery, specifically under tactics like Collection and Impact depending on the specific exploitation path taken. The ability to read local files corresponds to data exfiltration methods, while SSRF against metadata services is a common vector for lateral movement and privilege escalation in cloud-native architectures.
To mitigate this risk, organizations running openEQUELLA must upgrade immediately to version 2026.1 or later where the XML parser has been hardened to disable external entity resolution by default. For environments that cannot yet be upgraded, temporary mitigations include implementing strict input validation on all XML inputs received via the API endpoint and ensuring that the application service account operates with minimal file system permissions to limit the scope of potential data exposure. Additionally, network-level controls such as firewall rules or web application firewalls can be configured to block outbound requests from the openEQUELLA server to internal metadata endpoints if those services are not required for legitimate business operations. Regular security audits and penetration testing should also be conducted to verify that XML parsing components across all integrated systems adhere to secure coding standards regarding entity handling.