CVE-2026-94109

Summary

openEQUELLA before 2026.1.0 contains an authenticated stored server-side template injection vulnerability in FreemarkerPortletRenderer.renderHtml() that allows any authenticated non-guest user to achieve remote code execution by storing a malicious FreeMarker payload through a POST request to the RemotePortletService invoker endpoint. The markup field from stored portlet configuration is passed directly to custFactory.createResult() without a TemplateClassResolver restriction or FreeMarker sandboxing in BasicConfiguration, leaving built-ins such as ?new and freemarker.template.utility.Execute available, causing the payload to execute in the application server process context when any user renders a dashboard containing the affected portlet.

Affected Software

VendorProductVersion RangeStatus
openequellaopenEQUELLA0 < 2026.1.0affected
openequellaopenEQUELLA2026.1.0unaffected

Weaknesses

  • CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine

Workarounds

Deployments that can't upgrade immediately should firewall or VPN the /invoker/* endpoints and restrict them to only those who genuinely need access.

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: poc
    • Automatable: no
    • Technical Impact: total

References