medium6.1
CVE-2026-66089
In openEQUELLA before 2026.1, the SOAP API parses XML supplied in the stopEdit operation with a parser that resolves external entities.
Impact
In openEQUELLA before 2026.1, the SOAP API parses XML supplied in the stopEdit operation with a parser that resolves external entities. This allows an attacker to read arbitrary files accessible to the openEQUELLA service or cause the server to issue requests to attacker-specified locations (SSRF).
Affected products
| Product | Affected versions |
|---|---|
| OpenEQUELLA | before 2026.1 |
Versions were read from the advisory text. No structured product data has been published for this record yet.