Threats affecting pkg:github/openEQUELLA

openEQUELLA versions before 2026.1.0 contain an authenticated remote code execution vulnerability due to unsafe Java deserialization in the HTTP invoker endpoint. Authenticated non-guest users can exploit this by bypassing the class-name denylist via nested serialized payloads inside java.security.SignedObject, leading to arbitrary code execution. The issue is fixed in version 2026.1.0.

openEQUELLA versions before 2026.1.0 have an authenticated stored server-side template injection vulnerability in the FreemarkerPortletRenderer.renderHtml() function. This flaw allows any authenticated non-guest user to execute arbitrary code on the server by submitting a malicious FreeMarker template payload. The vulnerability occurs because the markup field from stored portlet configuration is passed without restrictions or sandboxing, enabling dangerous built-ins to run in the application server context. The issue is fixed in version 2026.1.0.