CVE-2026-66090 XML External Entity (XXE) Injection in Metadata Field Allows Arbitrary File Read
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-66090?
CVE-2026-66090 is a high-severity vulnerability in Apereo Foundation openEQUELLA, published on 29 Oct 2026.
Official description
In openEQUELLA before 2026.1, the XML parser used for item metadata does not disable external entity resolution. A user permitted to create items (CREATE_ITEM) can submit crafted XML to POST /api/item and cause the server to read arbitrary files accessible to the openEQUELLA service, or make requests to attacker-specified locations (SSRF), including cloud instance metadata services.
Weakness: CWE-611
Which versions are affected by CVE-2026-66090?
How do I fix CVE-2026-66090?
No fix has been published for CVE-2026-66090 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-66090 being exploited?
There is no known exploitation of CVE-2026-66090 in the wild and no public exploit code.
Sources
Also known as GHSA-555x-f7vj-p9qw, GHSA-668q-3hpr-6c96.