Openequella
Monthly
Authenticated remote code execution in openEQUELLA releases before 2026.1.0 lets any logged-in non-guest user execute arbitrary code on the server by sending a crafted serialized Java object to the HTTP invoker endpoint at /invoker/*. The flaw is a denylist bypass: the class-name filter in PluginAwareObjectInputStream is evaded by wrapping a malicious payload inside a java.security.SignedObject, whose inner stream is handled by a separate ObjectInputStream that never applies the denylist, ultimately routing into a JNDI lookup sink. No public exploit identified at time of analysis and the vulnerability is not in CISA KEV; the practical barrier is only the low-privilege account requirement (PR:L per the assessed CVSS:3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, scored 8.7 under CVSS 4.0), which is trivial to satisfy on instances that permit self-registration or broad SSO/LDAP provisioning.
Remote code execution in openEQUELLA before 2026.1.0 allows an authenticated attacker to execute arbitrary operating-system commands on the server by injecting FreeMarker template expressions into content surfaces they can author, such as collection summary sections, advanced-script wizard controls, dashboard portlets, and MIME display templates. The root cause is that the product's FreeMarker configuration (BasicConfiguration) relied on FreeMarker's default unrestricted TemplateClassResolver and left the ?api built-in reachable, so a payload such as <#assign ex="freemarker.template.utility.Execute"?new()>${ex("id")} instantiates the Execute utility and calls Runtime.exec. Exploitation requires a valid low-privilege account (CVSS 4.0 vector PR:L) plus passive user interaction when the malicious template is rendered (UI:P), and it is not possible against patched instances (2026.1.0+) which enforce SAFER_RESOLVER; no public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and EPSS is modest (0.92%, ~58th percentile), consistent with a high-severity but authentication-gated issue.
Authenticated remote code execution in openEQUELLA releases before 2026.1.0 lets any logged-in non-guest user execute arbitrary code on the server by sending a crafted serialized Java object to the HTTP invoker endpoint at /invoker/*. The flaw is a denylist bypass: the class-name filter in PluginAwareObjectInputStream is evaded by wrapping a malicious payload inside a java.security.SignedObject, whose inner stream is handled by a separate ObjectInputStream that never applies the denylist, ultimately routing into a JNDI lookup sink. No public exploit identified at time of analysis and the vulnerability is not in CISA KEV; the practical barrier is only the low-privilege account requirement (PR:L per the assessed CVSS:3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, scored 8.7 under CVSS 4.0), which is trivial to satisfy on instances that permit self-registration or broad SSO/LDAP provisioning.
Remote code execution in openEQUELLA before 2026.1.0 allows an authenticated attacker to execute arbitrary operating-system commands on the server by injecting FreeMarker template expressions into content surfaces they can author, such as collection summary sections, advanced-script wizard controls, dashboard portlets, and MIME display templates. The root cause is that the product's FreeMarker configuration (BasicConfiguration) relied on FreeMarker's default unrestricted TemplateClassResolver and left the ?api built-in reachable, so a payload such as <#assign ex="freemarker.template.utility.Execute"?new()>${ex("id")} instantiates the Execute utility and calls Runtime.exec. Exploitation requires a valid low-privilege account (CVSS 4.0 vector PR:L) plus passive user interaction when the malicious template is rendered (UI:P), and it is not possible against patched instances (2026.1.0+) which enforce SAFER_RESOLVER; no public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and EPSS is modest (0.92%, ~58th percentile), consistent with a high-severity but authentication-gated issue.