Live › vulnerability › CVE-2026-16889
Go to dashboardopenEQUELLA's pre-login notice image upload endpoint does not check file types and serves uploads with a Content-Type taken from the filename. An uploaded HTML file is then rendered from the openEQUELLA origin, so an attacker can run scripts in other users' sessions.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 02:36 UTC. All times on this page are UTC.
Only installations running openEQUELLA before 2026.1 are exposed. Exposure needs a user with to upload the file, so a default install with that permission restricted to admins carries a lower risk. Unauthenticated exploitation is possible only where the guest user or everyone holds that permission.
EDIT_SYSTEM_SETTINGSNo product ranges from the sources yet.
2026.1.EDIT_SYSTEM_SETTINGS, and whether the guest user or everyone has it.2026.1 or later.EDIT_SYSTEM_SETTINGS from the guest user and everyone roles.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In openEQUELLA before 2026.1, the pre-login notice image upload endpoint (PUT /api/preloginnotice/image/{name}) does not validate the type of uploaded files and serves them with a Content-Type derived from the supplied filename. A user holding the EDIT_SYSTEM_SETTINGS permission can upload an HTML file that is then served as text/html from the openEQUELLA origin, resulting in stored cross-site scripting. Unauthenticated exploitation is possible where EDIT_SYSTEM_SETTINGS has been granted to the guest user or everyone.
This page as .md · .json · in your agent: get_signal("CVE-2026-16889")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.