{"id":"CVE-2026-94109","aliases":["EUVD-2026-83731","GHSA-62g6-mmp6-9wv2","GHSA-w599-5qgp-f3cf"],"status":"published","title":"openEQUELLA \u003c 2026.1.0 Authenticated Stored SSTI via FreemarkerPortletRenderer","description":"openEQUELLA before 2026.1.0 contains an authenticated stored server-side template injection vulnerability in FreemarkerPortletRenderer.renderHtml() that allows any authenticated non-guest user to achieve remote code execution by storing a malicious FreeMarker payload through a POST request to the RemotePortletService invoker endpoint. The markup field from stored portlet configuration is passed directly to custFactory.createResult() without a TemplateClassResolver restriction or FreeMarker sandboxing in BasicConfiguration, leaving built-ins such as ?new and freemarker.template.utility.Execute available, causing the payload to execute in the application server process context when any user renders a dashboard containing the affected portlet.","severity":{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00778,"percentile":0.56318,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-1336"],"published":"2026-09-20T11:33:55Z","modified":"2026-10-31T07:10:24Z","products":[{"vendor":"openequella","product":"openequella"}],"references":[{"url":"https://blog.evan.lat/posts/openeq","tags":["technical-description","exploit","evidence"]},{"url":"https://github.com/openequella/openEQUELLA/commit/d6e165afc986f8a3ed912cdb367d5ad8c1eeab5c","tags":["patch","fix"]},{"url":"https://github.com/openequella/openEQUELLA/releases/tag/2026.1.0","tags":["release-notes","advisory"]},{"url":"https://github.com/openequella/openEQUELLA/security/advisories/GHSA-62g6-mmp6-9wv2","tags":["vendor-advisory","advisory"]},{"url":"https://www.vulncheck.com/advisories/openequella-authenticated-stored-ssti-via-freemarkerportletrenderer","tags":["third-party-advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94109","tags":["advisory"]},{"url":"https://github.com/openequella/openEQUELLA","tags":["package"]},{"url":"https://github.com/openequella/openEQUELLA/blob/8bd24b1dcf26cc3d74757e6b982fc1971a7d6767/Source/Plugins/Core/com.equella.core/src/com/tle/core/entity/service/impl/AbstractEntityServiceImpl.java#L230-L250"},{"url":"https://github.com/openequella/openEQUELLA/blob/8bd24b1dcf26cc3d74757e6b982fc1971a7d6767/Source/Plugins/Core/com.equella.core/src/com/tle/web/freemarker/BasicConfiguration.java"},{"url":"https://github.com/openequella/openEQUELLA/blob/8bd24b1dcf26cc3d74757e6b982fc1971a7d6767/Source/Plugins/Core/com.equella.core/src/com/tle/web/portal/standard/renderer/FreemarkerPortletRenderer.java#L141-L170"},{"url":"https://www.vulncheck.com/advisories/openequella-before-2026.1.0-remote-code-execution-via-freemarker-template-injection"},{"url":"https://github.com/advisories/GHSA-w599-5qgp-f3cf"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/94xxx/CVE-2026-94109.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-94109","title":"openEQUELLA \u003c 2026.1.0 Authenticated Stored SSTI via FreemarkerPortletRenderer","description":"openEQUELLA before 2026.1.0 contains an authenticated stored server-side template injection vulnerability in FreemarkerPortletRenderer.renderHtml() that allows any authenticated non-guest user to achieve remote code execution by storing a malicious FreeMarker payload through a POST request to the RemotePortletService invoker endpoint. The markup field from stored portlet configuration is passed directly to custFactory.createResult() without a TemplateClassResolver restriction or FreeMarker sandboxing in BasicConfiguration, leaving built-ins such as ?new and freemarker.template.utility.Execute available, causing the payload to execute in the application server process context when any user renders a dashboard containing the affected portlet.","status":"published","published":"2026-09-20T11:33:55.754Z","modified":"2026-10-29T12:27:38.736Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-1336"],"updated_at":"2026-11-02T14:19:54.122945Z"}],"euvd":[{"id":"EUVD-2026-83731","description":"openEQUELLA before 2026.1.0 contains an authenticated stored server-side template injection vulnerability in FreemarkerPortletRenderer.renderHtml() that allows any authenticated non-guest user to achieve remote code execution by storing a malicious FreeMarker payload through a POST request to the RemotePortletService invoker endpoint. The markup field from stored portlet configuration is passed directly to custFactory.createResult() without a TemplateClassResolver restriction or FreeMarker sandboxing in BasicConfiguration, leaving built-ins such as ?new and freemarker.template.utility.Execute available, causing the payload to execute in the application server process context when any user renders a dashboard containing the affected portlet.","status":"published","published":"2026-09-20T11:33:55Z","modified":"2026-10-29T12:27:38Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T16:59:16.844933Z"}],"ghsa":[{"id":"GHSA-w599-5qgp-f3cf","title":"openEQUELLA versions before 2026.1.0 contain a remote code execution vulnerability in FreeMarker...","description":"openEQUELLA versions before 2026.1.0 contain a remote code execution vulnerability in FreeMarker template compilation due to an unsandboxed TemplateClassResolver configuration. Authenticated attackers can inject malicious template expressions through collection summaries, dashboard portlets, or MIME templates to instantiate dangerous classes like freemarker.template.utility.Execute and invoke Runtime.exec for arbitrary command execution.","status":"published","published":"2026-09-20T12:30:27Z","modified":"2026-10-29T15:31:33Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-1336"],"updated_at":"2026-11-02T15:14:39.34849Z"}],"nvd":[{"id":"CVE-2026-94109","description":"openEQUELLA before 2026.1.0 contains an authenticated stored server-side template injection vulnerability in FreemarkerPortletRenderer.renderHtml() that allows any authenticated non-guest user to achieve remote code execution by storing a malicious FreeMarker payload through a POST request to the RemotePortletService invoker endpoint. The markup field from stored portlet configuration is passed directly to custFactory.createResult() without a TemplateClassResolver restriction or FreeMarker sandboxing in BasicConfiguration, leaving built-ins such as ?new and freemarker.template.utility.Execute available, causing the payload to execute in the application server process context when any user renders a dashboard containing the affected portlet.","status":"published","published":"2026-09-20T12:17:06.62Z","modified":"2026-10-29T13:17:16.387Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-1336"],"updated_at":"2026-11-02T14:12:50.043898Z"}],"osv":[{"id":"CVE-2026-94109","title":"openEQUELLA \u003c 2026.1.0 Authenticated Stored SSTI via FreemarkerPortletRenderer","description":"openEQUELLA before 2026.1.0 contains an authenticated stored server-side template injection vulnerability in FreemarkerPortletRenderer.renderHtml() that allows any authenticated non-guest user to achieve remote code execution by storing a malicious FreeMarker payload through a POST request to the RemotePortletService invoker endpoint. The markup field from stored portlet configuration is passed directly to custFactory.createResult() without a TemplateClassResolver restriction or FreeMarker sandboxing in BasicConfiguration, leaving built-ins such as ?new and freemarker.template.utility.Execute available, causing the payload to execute in the application server process context when any user renders a dashboard containing the affected portlet.","status":"published","published":"2026-09-20T11:33:55.754Z","modified":"2026-10-31T07:10:24.58458487Z","cvss":[{"version":"4.0","score":8.6,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-1336"],"updated_at":"2026-11-02T15:45:20.931171Z"}]}}