openEQUELLA EUVD-2026-112563

The attacker must be able to call PUT /api/preloginnotice/image/{name} while holding the EDIT_SYSTEM_SETTINGS permission, and must upload a file whose supplied name yields an HTML Content-Type so the payload is served as text/html from the openEQUELLA origin. Exploitation then requires a victim to load the pre-login notice page (UI:P). The primary limiting factor is that EDIT_SYSTEM_SETTINGS is normally an administrative/high-privilege setting, so by default this requires a privileged account; it becomes unauthenticated ONLY in the non-default configuration where EDIT_SYSTEM_SETTINGS has been explicitly granted to the guest user or 'everyone'. Applies to openEQUELLA versions 2019.1 through before 2026.1.

This is a genuine but low-to-moderate priority issue rather than a top-tier emergency. The CVSS 4.0 base score is 4.8 (Medium) with the vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N: network reachable and low complexity, but gated by high privileges (PR:H - the EDIT_SYSTEM_SETTINGS permission) and requiring victim interaction (UI:P, a user loading the pre-login page). The only impact is to the subsequent system (SC:L/SI:L, the victim's browser session) with no direct confidentiality, integrity, or availability impact to openEQUELLA itself (VC/VI/VA:N), consistent with stored XSS. The vuln.today decision label is 'this_month', not act_now or emergency, so this is a scheduled-patch item. No EPSS score was provided and the CVE is not listed in CISA KEV, so there is no public exploitation-probability signal and no confirmed active exploitation - this is 'no public exploit identified at time of analysis'. No SSVC exploitation/automatable/technical-impact values were supplied beyond the vuln.today priority. The one amplifying factor is the description's note that unauthenticated exploitation becomes possible where EDIT_SYSTEM_SETTINGS has been granted to the guest user or everyone; that is a non-default misconfiguration and not reflected in the PR:H baseline vector, so real-world risk is highly dependent on each deployment's permission model. Treat normal instances as authenticated/high-privilege stored XSS and prioritize misconfigured instances where the permission is public.

An actor holding the EDIT_SYSTEM_SETTINGS permission uploads an HTML file containing script via PUT /api/preloginnotice/image/{name}; because the endpoint serves it as text/html from the openEQUELLA origin, the script runs in the browser of any user who subsequently loads the pre-login notice page, enabling stored cross-site scripting. In deployments where EDIT_SYSTEM_SETTINGS has been granted to the guest user or everyone, this upload can be performed without authentication. No public exploit code is identified at time of analysis, though a vendor security advisory (GHSA-q2xv-rffq-mj5w) documents the flaw.