CVE-2026-94109

Description

openEQUELLA before 2026.1.0 contains an authenticated stored server-side template injection vulnerability in FreemarkerPortletRenderer.renderHtml() that allows any authenticated non-guest user to achieve remote code execution by storing a malicious FreeMarker payload through a POST request to the RemotePortletService invoker endpoint. The markup field from stored portlet configuration is passed directly to custFactory.createResult() without a TemplateClassResolver restriction or FreeMarker sandboxing in BasicConfiguration, leaving built-ins such as ?new and freemarker.template.utility.Execute available, causing the payload to execute in the application server process context when any user renders a dashboard containing the affected portlet.

Traduire en français

Produits concernés

• openEQUELLA

Scores CVSS

Faiblesses (CWE)

• CWE-1336

Références

• https://blog.evan.lat/posts/openeq
• https://github.com/openequella/openEQUELLA/commit/d6e165afc986f8a3ed912cdb367d5ad8c1eeab5c
• https://github.com/openequella/openEQUELLA/releases/tag/2026.1.0
• https://www.vulncheck.com/advisories/openequella-authenticated-stored-ssti-via-freemarkerportletrenderer

Ailleurs

• NVD
• CVE.org
• CIRCL Vulnerability-Lookup
• CERT-FR
• GitHub Advisories