Apereo openEQUELLA up to 2026.0 Image Upload Endpoint image name cross site scripting

Summaryinfo

A vulnerability described as problematic has been identified in Apereo openEQUELLA up to 2026.0. This impacts an unknown function of the file /api/preloginnotice/image of the component Image Upload Endpoint. Executing a manipulation of the argument Name can lead to cross site scripting. This vulnerability is tracked as CVE-2026-16889. The attack can be launched remotely. No exploit exists. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in Apereo openEQUELLA up to 2026.0. It has been declared as problematic. This vulnerability affects an unknown code block of the file /api/preloginnotice/image of the component Image Upload Endpoint. The manipulation of the argument name with an unknown input leads to a cross site scripting vulnerability. The CWE definition for the vulnerability is CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. As an impact it is known to affect integrity. CVE summarizes:

In openEQUELLA before 2026.1, the pre-login notice image upload endpoint (PUT /api/preloginnotice/image/{name}) does not validate the type of uploaded files and serves them with a Content-Type derived from the supplied filename. A user holding the EDIT_SYSTEM_SETTINGS permission can upload an HTML file that is then served as text/html from the openEQUELLA origin, resulting in stored cross-site scripting. Unauthenticated exploitation is possible where EDIT_SYSTEM_SETTINGS has been granted to the guest user or everyone.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-16889 since 07/24/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1059.007.

Upgrading to version 2026.1 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-112563). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• Apereo

Name

• openEQUELLA

Version

• 2026

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion