Vulnerability · Published Oct 29, 2026 · Assigned by MON-CSIRT

CVE-2026-16889Stored XSS via Pre-Login Notice Image Upload Serves Attacker HTML from Application Origin

Medium 4.8

In plain English

A medium-severity unrestricted file upload in openEQUELLA from Apereo Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).

Severity (CVSS 4.0)4.8Medium

Exploit odds (30 days)0.3%top 75.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

In openEQUELLA before 2026.1, the pre-login notice image upload endpoint (PUT /api/preloginnotice/image/{name}) does not validate the type of uploaded files and serves them with a Content-Type derived from the supplied filename. A user holding the EDIT_SYSTEM_SETTINGS permission can upload an HTML file that is then served as text/html from the openEQUELLA origin, resulting in stored cross-site scripting. Unauthenticated exploitation is possible where EDIT_SYSTEM_SETTINGS has been granted to the guest user or everyone.

Affected products (as reported)

Vendor	Product	Versions
Apereo Foundation	openEQUELLA	2019.1 – before 2026.1

Weakness: CWE-434 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

References

https://github.com/openequella/openEQUELLA/security/advisories/GHSA-q2xv-rffq-mj5w vendor-advisory
https://openequella.github.io/guides/ product