{"id":"CVE-2026-66090","published":"2026-10-29T02:16:52.803","lastModified":"2026-10-29T04:18:39.960","description":"In openEQUELLA before 2026.1, the XML parser used for item metadata does not disable external entity resolution. A user permitted to create items (CREATE_ITEM) can submit crafted XML to POST /api/item and cause the server to read arbitrary files accessible to the openEQUELLA service, or make requests to attacker-specified locations (SSRF), including cloud instance metadata services.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-611"],"vendors":[],"products":[],"references":[{"url":"https://github.com/openequella/openEQUELLA/security/advisories/GHSA-668q-3hpr-6c96","tags":[]},{"url":"https://openequella.github.io/guides/","tags":[]}],"exploitRefs":[{"url":"https://github.com/openequella/openEQUELLA/security/advisories/GHSA-668q-3hpr-6c96","tags":[]}],"hasPoc":true,"ai":null}