{"id":"CVE-2026-66089","published":"2026-10-29T02:16:52.663","lastModified":"2026-10-29T04:18:39.803","description":"In openEQUELLA before 2026.1, the SOAP API parses XML supplied in the stopEdit operation with a parser that resolves external entities. This allows an attacker to read arbitrary files accessible to the openEQUELLA service or cause the server to issue requests to attacker-specified locations (SSRF).","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-611"],"vendors":[],"products":[],"references":[{"url":"https://github.com/openequella/openEQUELLA/security/advisories/GHSA-f9wv-5rpf-rq45","tags":[]},{"url":"https://openequella.github.io/guides/","tags":[]}],"exploitRefs":[{"url":"https://github.com/openequella/openEQUELLA/security/advisories/GHSA-f9wv-5rpf-rq45","tags":[]}],"hasPoc":true,"ai":null}