CVE-2026-66089

CVSS 6.1 (medium) · published 2026-10-29

In openEQUELLA before 2026.1, the SOAP API parses XML supplied in the stopEdit operation with a parser that resolves external entities. This allows an attacker to read arbitrary files accessible to the openEQUELLA service or cause the server to issue requests to attacker-specified locations (SSRF).

Weakness: CWE-611

Source: NVD CVE-2026-66089

References

• https://github.com/openequella/openEQUELLA/security/advisories/GHSA-f9wv-5rpf-rq45
• https://openequella.github.io/guides/

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.