CVE-2026-66088

Unrestricted Command Execution via system.execute

State: Published
Severity: 9.4 Critical
Published: Oct 29, 2026
Updated: Oct 29, 2026
Reserved: Jul 24, 2026

Description

In openEQUELLA before 2026.1, the system.execute() function available to the scripting engine runs supplied operating system commands without validation or an allow-list of permitted executables. A user able to create or edit scripts can use it to execute arbitrary commands with the privileges of the openEQUELLA service account.

Scores

CVSS	Score	Vector	Source
4.0	9.4 Critical	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:L	MON-CSIRT

Weaknesses

CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection')
CWE-749 Exposed dangerous method or function

Affected Products

Product	Versions
openEQUELLAApereo Foundation	before 2026.1Affected

References

https://github.com/openequella/openEQUELLA/security/advisories/GHSA-q8xp-w3fr-hj4vvendor-advisory
https://openequella.github.io/guides/product

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.