openEQUELLA versions before 2026.1 contain a vulnerability in the XML parser used for item metadata. The parser does not disable external entity resolution, allowing a user with CREATE_ITEM permission to submit crafted XML to the POST /api/item endpoint. This can lead to the server reading arbitrary files accessible to the service or making server-side requests to attacker-specified locations, including cloud instance metadata services.