CVE-2026-66089
Received Received - Intake

XML External Entity Injection in openEQUELLA

Publication date: 2026-10-29

Last updated on: 2026-10-29

Assigner: MON-CSIRT

Description
In openEQUELLA before 2026.1, the SOAP API parses XML supplied in the stopEdit operation with a parser that resolves external entities. This allows an attacker to read arbitrary files accessible to the openEQUELLA service or cause the server to issue requests to attacker-specified locations (SSRF).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-29
Last Modified
2026-10-29
Generated
2026-10-29
AI Q&A
2026-10-29
EPSS Evaluated
N/A
NVD
CVE-2026-66089
EUVD
EUVD-2026-112565

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Apereo Foundation openEQUELLA 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-611 The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in openEQUELLA before version 2026.1. The SOAP API's stopEdit operation uses an XML parser that resolves external entities. Attackers can exploit this to read arbitrary files accessible to the openEQUELLA service or perform Server-Side Request Forgery (SSRF) by making the server issue requests to attacker-specified locations.

Detection Guidance

Check if your openEQUELLA version is before 2026.1. Monitor network traffic for unexpected outbound requests or unusual file access patterns. Review server logs for XML parsing errors or external entity resolution attempts.

Impact Analysis

An attacker could access sensitive files on the server running openEQUELLA, such as configuration files or other restricted data. They could also use the server to make unauthorized requests to internal or external systems, potentially leading to further attacks or data exfiltration.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's security rules. Organizations using affected versions may face compliance violations, legal penalties, and reputational damage due to potential data breaches.

Mitigation Strategies

Upgrade openEQUELLA to version 2026.1 or later immediately. Disable external entity resolution in the SOAP API configuration. Restrict network access to the SOAP API endpoint to trusted sources only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-66089. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart