CVE-2026-94109 openEQUELLA < 2026.1.0 Authenticated Stored SSTI via FreemarkerPortletRenderer
Authenticated users can achieve remote code execution in openEQUELLA by injecting malicious FreeMarker templates into portlet configurations.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-94109?
CVE-2026-94109 is a high-severity code injection vulnerability in openEQUELLA, published on 20 Sep 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
openEQUELLA before 2026.1.0 contains an authenticated stored server-side template injection vulnerability in FreemarkerPortletRenderer.renderHtml() that allows any authenticated non-guest user to achieve remote code execution by storing a malicious FreeMarker payload through a POST request to the RemotePortletService invoker endpoint. The markup field from stored portlet configuration is passed directly to custFactory.createResult() without a TemplateClassResolver restriction or FreeMarker sandboxing in BasicConfiguration, leaving built-ins such as ?new and freemarker.template.utility.Execute available, causing the payload to execute in the application server process context when any user renders a dashboard containing the affected portlet.
Weakness: CWE-1336
Which versions are affected by CVE-2026-94109?
How do I fix CVE-2026-94109?
No fix has been published for CVE-2026-94109 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-94109 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-94109 exists.
Sources
Also known as GHSA-62g6-mmp6-9wv2, GHSA-w599-5qgp-f3cf.