EUVD-2026-83731
GHSA-w599-5qgp-f3cf
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable template input needs only a low-privilege account (PR:L) and low complexity (AC:L); stored payload renders on interaction (UI:R), and command execution yields full C:H/I:H/A:H within the app's process (S:U).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
6DescriptionCVE.org
openEQUELLA versions before 2026.1.0 contain a remote code execution vulnerability in FreeMarker template compilation due to an unsandboxed TemplateClassResolver configuration. Authenticated attackers can inject malicious template expressions through collection summaries, dashboard portlets, or MIME templates to instantiate dangerous classes like freemarker.template.utility.Execute and invoke Runtime.exec for arbitrary command execution.
Articles & Coverage 1
AnalysisAI
Remote code execution in openEQUELLA before 2026.1.0 allows an authenticated attacker to execute arbitrary operating-system commands on the server by injecting FreeMarker template expressions into content surfaces they can author, such as collection summary sections, advanced-script wizard controls, dashboard portlets, and MIME display templates. The root cause is that the product's FreeMarker configuration (BasicConfiguration) relied on FreeMarker's default unrestricted TemplateClassResolver and left the ?api built-in reachable, so a payload such as <#assign ex="freemarker.template.utility.Execute"?new()>${ex("id")} instantiates the Execute utility and calls Runtime.exec. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated account (PR:L) with the ability to supply template text through one of the affected input surfaces named in the description: collection summary sections, advanced-script wizard controls, dashboard portlets, or MIME display templates. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority vulnerability, though gated by authentication. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to openEQUELLA 2026.1.0, which contains the vendor-released fix for this issue; the hardening lands in commit d6e165afc986f8a3ed912cdb367d5ad8c1eeab5c and the tagged release https://github.com/openequella/openEQUELLA/releases/tag/2026.1.0, and it works by setting FreeMarker's TemplateClassResolver to SAFER_RESOLVER (blocking Execute, ObjectConstructor and JythonRuntime by name while still allowing openEQUELLA's own TemplateModel directive classes) and by explicitly disabling the ?api built-in, so legitimate built-in templates continue to render. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all openEQUELLA deployments, confirm which instances run a version earlier than 2026.1.0, and restrict authoring privileges on those instances to trusted accounts only; if the platform is internet-facing, reduce its exposure and increase monitoring of server-side process and command execution. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during
Share
External POC / Exploit Code
Leaving vuln.today