Read the docs
TI-2026-82260 Aliases CVE-2026-16889GHSA-jj9r-xgj6-prvj

Stored XSS via pre-login notice image upload in openEQUELLA

Priority LOW 22CWE-434Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-434.

Summary

openEQUELLA from 2019.1 before 2026.1 does not validate the type of files uploaded to the pre-login notice image endpoint, and it serves them with a Content-Type taken from the supplied filename. A user holding the EDIT_SYSTEM_SETTINGS permission can upload an HTML file that is then served as text/html from the openEQUELLA origin, which causes stored cross-site scripting (CWE-434). Unauthenticated exploitation is possible where EDIT_SYSTEM_SETTINGS has been granted to the guest user or everyone.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

In openEQUELLA before 2026.1, the pre-login notice image upload endpoint (PUT /api/preloginnotice/image/{name}) does not validate the type of uploaded files and serves them with a Content-Type derived from the supplied filename. A user holding the EDIT_SYSTEM_SETTINGS permission can upload an HTML file that is then served as text/html from the openEQUELLA origin, resulting in stored cross-site scripting. Unauthenticated exploitation is possible where EDIT_SYSTEM_SETTINGS has been granted to the guest user or everyone.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00315 24th percentileScored 2026-11-07
Fix Fixed openEQUELLA (Apereo Foundation): 2026.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Apereo FoundationopenEQUELLA2019.1 to before 2026.12026.1Patch availableCNA
  • openEQUELLA VendorApereo Foundation Affected 2019.1 to before 2026.1 Fixed in 2026.1 Patch available CNA

Remediation

Upgrade openEQUELLA to version 2026.1 or later, which fixes the issue. No vendor advisory identifier is listed in the sources.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA openEQUELLA (Apereo Foundation) Fixed in 2026.1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Apereo Foundation openEQUELLA 2026.1

    5 records Highest priority Priority MEDIUM 1 MEDIUM, 4 LOW

    Other records, highest priority first

    • TI-2026-82261 OS command injection in openEQUELLA via system.executePriority MEDIUM 44
    • TI-2026-82264 Unauthenticated access to user details in openEQUELLAPriority LOW 37
    • TI-2026-82263 XML external entity injection in openEQUELLA allows file readsPriority LOW 31
    Show all 5 records →

Timeline

  1. 2026-10-29 Threatist record created from CVE-2026-16889
  2. 2026-10-29 CISA SSVC decision points changed
  3. 2026-10-29 Alias added: GHSA-jj9r-xgj6-prvj

References

Advisory 1

Other 1

  • TI-2026-47769 openEQUELLA < 2026.1.0 Authenticated RCE via Java Deserialization in HTTP Invoker CVSS 4.0HIGH 8.7
  • TI-2026-82261 OS command injection in openEQUELLA via system.execute CVSS 4.0CRITICAL 9.4
  • TI-2026-82264 Unauthenticated access to user details in openEQUELLA CVSS 4.0MEDIUM 6.9
  • TI-2026-82263 XML external entity injection in openEQUELLA allows file reads CVSS 4.0HIGH 7.1
  • TI-2026-82262 XML external entity injection in openEQUELLA SOAP API lets attackers read files CVSS 4.0MEDIUM 6.1
  • TI-2026-82265 Stored XSS in openEQUELLA pre-login notice via legacy logon page CVSS 4.0MEDIUM 4.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences