XML External Entity Vulnerability in openEQUELLA by Pearson
CVE-2026-66089

6.1MEDIUM

Key Information:

Vendor

Apereo Foundation

Status
Openequella
Vendor
CVE Published:
29 October 2026

What is CVE-2026-66089?

A vulnerability exists in openEQUELLA prior to version 2026.1, where the SOAP API inadequately handles XML input in the stopEdit operation. This flaw allows attackers to exploit external entity processing, leading to unauthorized access to sensitive files within the openEQUELLA service or enabling server-side request forgery (SSRF), where requests can be directed towards malicious locations defined by an attacker.

Affected Version(s)

openEQUELLA 0 < 2026.1

openEQUELLA 2026.1

References

https://github.com/openequella/openEQUELLA/security/advis...
vendor-advisory
https://openequella.github.io/guides/
product

CVSS V4

Score:
6.1
Severity:
MEDIUM
Confidentiality:
High
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

dr0v3r
.