CVE-2026-94109

8 HIGHpublic exploit available

Published 2026-09-20 · Updated 2026-09-24

AI risk analysis

Summary: This vulnerability allows authenticated users to execute arbitrary code by injecting malicious FreeMarker templates, posing a significant risk to the application's security.
Exploitability: Exploitation requires an authenticated user with non-guest privileges and knowledge of FreeMarker template injection techniques. The attacker must send a POST request to the RemotePortletService invoker endpoint.
Blast radius: If exploited, the vulnerability could lead to complete compromise of the application server, allowing the attacker to execute arbitrary code with the server's privileges.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Upgrade to openEQUELLA 2026.1.0 or later.

rcewebauth-bypass

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

openEQUELLA before 2026.1.0 contains an authenticated stored server-side template injection vulnerability in FreemarkerPortletRenderer.renderHtml() that allows any authenticated non-guest user to achieve remote code execution by storing a malicious FreeMarker payload through a POST request to the RemotePortletService invoker endpoint. The markup field from stored portlet configuration is passed directly to custFactory.createResult() without a TemplateClassResolver restriction or FreeMarker sandboxing in BasicConfiguration, leaving built-ins such as ?new and freemarker.template.utility.Execute available, causing the payload to execute in the application server process context when any user renders a dashboard containing the affected portlet.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Weaknesses

CWE-1336

Public exploit & PoC references

References

Data: NVD (public domain). Analysis: local $0 model. Defensive use only.