CVE-2026-94109
openEQUELLA < 2026.1.0 Authenticated Stored SSTI via FreemarkerPortletRenderer
- State
- Published
- Severity
- 8.6 High
- Published
- Sep 20, 2026
- Updated
- Oct 29, 2026
- Reserved
- Sep 20, 2026
Description
openEQUELLA before 2026.1.0 contains an authenticated stored server-side template injection vulnerability in FreemarkerPortletRenderer.renderHtml() that allows any authenticated non-guest user to achieve remote code execution by storing a malicious FreeMarker payload through a POST request to the RemotePortletService invoker endpoint. The markup field from stored portlet configuration is passed directly to custFactory.createResult() without a TemplateClassResolver restriction or FreeMarker sandboxing in BasicConfiguration, leaving built-ins such as ?new and freemarker.template.utility.Execute available, causing the payload to execute in the application server process context when any user renders a dashboard containing the affected portlet.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.6 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 8.0 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine
Affected Products
| Product | Versions |
|---|---|
openEQUELLAopenequella |
|
References
- Researcher Blogtechnical-descriptionexploit
- Patch Commitpatch
- openEQUELLA 2026.1.0 Release Notesrelease-notes
- GitHub Security Advisory (GHSA-62g6-mmp6-9wv2)vendor-advisory
- VulnCheck Advisorythird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.