Vulnerability in Openequella
CVE-2026-94109
openEQUELLA before 2026.1.0 contains an authenticated stored server-side template injection vulnerability in FreemarkerPortletRenderer.renderHtml() that allows any authenticated non-guest user to achieve remote code execution by storing a malicious FreeMarker payload through a POST request to the RemotePortletService invoker endpoint. The markup field from stored portlet configuration is passed directly to custFactory.createResult() without a TemplateClassResolver restriction or FreeMarker sandboxing in BasicConfiguration, leaving built-ins such as ?new and freemarker.template.utility.Execute available, causing the payload to execute in the application server process context when any user renders a dashboard containing the affected portlet.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.0 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.008 (55.9th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 56th percentile — 55.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.008 · newest: 0.008 · change: 0.000
Affected products
Weakness classification (CWE)
References
- github.com/openequella/openEQUELLA/commit/d6e165afc986f8a3ed912cdb367d5ad8c1eea… (patch)
- github.com/openequella/openEQUELLA/releases/tag/2026.1.0 (release-notes)
- github.com/openequella/openEQUELLA/blob/8bd24b1dcf26cc3d74757e6b982fc1971a7d676… (technical-description)
- github.com/openequella/openEQUELLA/blob/8bd24b1dcf26cc3d74757e6b982fc1971a7d676… (technical-description)
- github.com/openequella/openEQUELLA/blob/8bd24b1dcf26cc3d74757e6b982fc1971a7d676… (technical-description)
- github.com/openequella/openEQUELLA (product)
- www.vulncheck.com/advisories/openequella-before-2026.1.0-remote-code-execution-… (third-party-advisory)
- www.vulncheck.com/advisories/openequella-authenticated-stored-ssti-via-freemark… (third-party-advisory)
- blog.evan.lat/posts/openeq (technical-description, exploit)
- github.com/openequella/openEQUELLA/security/advisories/GHSA-62g6-mmp6-9wv2 (vendor-advisory)
Frequently asked questions
- What is CVE-2026-94109?
- CVE-2026-94109 is a high-severity vulnerability in Openequella, classified under Improper Neutralization of Special Elements Used in a Template Engine. CVSS score: 8.0/10. Published 2026-09-20.
- How severe is CVE-2026-94109?
- High severity. CVSS v3 base score is 8.0 out of 10.