CVE-2026-16889 Stored XSS via Pre-Login Notice Image Upload Serves Attacker HTML from Application Origin
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-16889?
CVE-2026-16889 is a medium-severity vulnerability in Apereo Foundation openEQUELLA, published on 29 Oct 2026.
Official description
In openEQUELLA before 2026.1, the pre-login notice image upload endpoint (PUT /api/preloginnotice/image/{name}) does not validate the type of uploaded files and serves them with a Content-Type derived from the supplied filename. A user holding the EDIT_SYSTEM_SETTINGS permission can upload an HTML file that is then served as text/html from the openEQUELLA origin, resulting in stored cross-site scripting. Unauthenticated exploitation is possible where EDIT_SYSTEM_SETTINGS has been granted to the guest user or everyone.
Weakness: CWE-434
Which versions are affected by CVE-2026-16889?
How do I fix CVE-2026-16889?
No fix has been published for CVE-2026-16889 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-16889 being exploited?
There is no known exploitation of CVE-2026-16889 in the wild and no public exploit code.
Sources
Also known as GHSA-jj9r-xgj6-prvj, GHSA-q2xv-rffq-mj5w.