Vulnerability · Published Oct 29, 2026 · Assigned by MON-CSIRT

CVE-2026-66090XML External Entity (XXE) Injection in Metadata Field Allows Arbitrary File Read

High 7.1

In plain English

A high-severity XML external entity in openEQUELLA from Apereo Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities).

Severity (CVSS 4.0)7.1High

Exploit odds (30 days)0.3%top 80.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

In openEQUELLA before 2026.1, the XML parser used for item metadata does not disable external entity resolution. A user permitted to create items (CREATE_ITEM) can submit crafted XML to POST /api/item and cause the server to read arbitrary files accessible to the openEQUELLA service, or make requests to attacker-specified locations (SSRF), including cloud instance metadata services.

Affected products (as reported)

Vendor	Product	Versions
Apereo Foundation	openEQUELLA	0 – before 2026.1

Weakness: CWE-611 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N

References

https://github.com/openequella/openEQUELLA/security/advisories/GHSA-668q-3hpr-6c96 vendor-advisory
https://openequella.github.io/guides/ product