CVE-2026-94109
openEQUELLA < 2026.1.0 Authenticated Stored SSTI via FreemarkerPortletRenderer
openEQUELLA before 2026.1.0 contains an authenticated stored server-side template injection vulnerability in FreemarkerPortletRenderer.renderHtml() that allows any authenticated non-guest user to achieve remote code execution by storing a malicious FreeMarker payload through a POST request to the RemotePortletService invoker endpoint. The markup field from stored portlet configuration is passed directly to custFactory.createResult() without a TemplateClassResolver restriction or FreeMarker sandboxing in BasicConfiguration, leaving built-ins such as ?new and freemarker.template.utility.Execute available, causing the payload to execute in the application server process context when any user renders a dashboard containing the affected portlet.
| CWE | CWE-1336 |
| Vendor | openequella |
| Product | openequella |
| Published | Sep 20, 2026 |
| Last Updated | Oct 29, 2026 |
Get instant alerts for openequella openequella
Be the first to know when new high vulnerabilities affecting openequella openequella are published — delivered to Slack, Telegram or Discord.
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H