High severity · published Oct 29, 2026
CVE-2026-66090
XML External Entity (XXE) Injection in Metadata Field Allows Arbitrary File Read
New
7.1
CVSS
–
EPSS
No
On KEV
Description
In openEQUELLA before 2026.1, the XML parser used for item metadata does not disable external entity resolution. A user permitted to create items (CREATE_ITEM) can submit crafted XML to POST /api/item and cause the server to read arbitrary files accessible to the openEQUELLA service, or make requests to attacker-specified locations (SSRF), including cloud instance metadata services.
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
openEQUELLA · Apereo Foundation
before 2026.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-66090
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-66090
vendor-advisory
https://github.com/openequella/openEQUELLA/security/advisories/GHSA-668q-3hpr-6c96
product
https://openequella.github.io/guides/
More from openEQUELLA
9.4
CVE-2026-66088
Unrestricted Command Execution via system.execute
8.8
CVE-2026-67615
openEQUELLA < 2026.1.0 Authenticated RCE via Java Deserialization in HTTP Invoker
6.9
CVE-2026-66091
Unauthenticated IDOR Enables Disclosure of Other Users’ last-known details
6.1
CVE-2026-66089
XML External Entity (XXE) Vulnerability in SOAP Interface Allows External Entity Expansion
4.8
CVE-2026-66092
Stored XSS in pre-login notice via reachable legacy logon route