Stored Cross-Site Scripting in openEQUELLA Prior to Version 2026.1
CVE-2026-16889

4.8MEDIUM

Key Information:

Vendor

Apereo Foundation

Status
Openequella
Vendor
CVE Published:
29 October 2026

What is CVE-2026-16889?

In versions of openEQUELLA prior to 2026.1, the system fails to properly validate the type of files uploaded via the pre-login notice image upload endpoint. This flaw allows a user with the EDIT_SYSTEM_SETTINGS permission to upload potentially malicious HTML files. These files, when served by openEQUELLA, can lead to stored cross-site scripting vulnerabilities, especially if the permission is granted to unauthenticated users or guests. This poses significant risks for data integrity and user security.

Affected Version(s)

openEQUELLA 2019.1 < 2026.1

References

https://github.com/openequella/openEQUELLA/security/advis...
vendor-advisory
https://openequella.github.io/guides/
product

CVSS V4

Score:
4.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Lê Ngọc Bảo Minh ( University of Information Technology: VNUHCM - UIT )
.