openEQUELLA CVE-2026-66088

Requires an authenticated openEQUELLA account that holds permission to create or edit scripts in the scripting engine; such a user can call the system.execute() function, which runs supplied OS commands without any validation or allow-list of permitted executables (CWE-78), executing them with the openEQUELLA service account's privileges. This is NOT remotely unauthenticated - the PR:L gate means the limiting factor is the script create/edit privilege, which is normally a trusted content-manager or administrator role, substantially narrowing the pool of capable attackers. Affects all versions before 2026.1; the complete fix is upgrading to 2026.1 per the vendor advisory.

This is a genuine high-priority issue rather than a high-CVSS-but-low-real-risk one, though the raw 9.4 should be read against its one real gate: privileges. The flaw is OS command injection (CWE-78) in the scripting engine's system.execute(), which runs supplied commands with no validation or executable allow-list, yielding command execution as the openEQUELLA service account - effectively host compromise that escapes the application boundary (reflected in the input 4.0 vector's subsequent-system impact SC:H/SI:H and scope change). The input CVSS 4.0 vector is AV:N/AC:L/AT:N/PR:L/UI:N, so exploitation is network-reachable, low-complexity, and needs no user interaction, but PR:L means it is NOT unauthenticated: an attacker must already hold an account permitted to create or edit scripts, which is typically a trusted content-manager/administrator function. The vuln.today decision label is act_now and the vendor has shipped a patch, both pushing toward prompt remediation. However, key exploitation-likelihood signals are absent: no EPSS score is provided, the CVE is not listed in CISA KEV, and no public exploit or PoC reference is supplied (only a vendor advisory and documentation). So exploitation is plausible and easy for anyone already holding script privileges, but there is no evidence of active exploitation or weaponization; the act_now label here reflects severity and patch availability rather than confirmed in-the-wild activity. Note the PR gating tension to verify with the vendor: the description's 'user able to create or edit scripts' may in practice be an administrative role, which would argue for PR:H and a somewhat lower real-world population of capable attackers.

An attacker who holds (or phishes/compromises) an openEQUELLA account with permission to create or edit scripts authors a script that calls system.execute() with attacker-chosen operating-system commands. When the script runs, those commands execute with the privileges of the openEQUELLA service account, giving the attacker a foothold on the host, data access, and a path to further compromise. No public exploit code has been identified; exploitation is straightforward for anyone with the required script-editing privilege.