Threats tagged 'ghsa-64mg-3wpj-rcr6'

In openEQUELLA versions before 2026.1, the system.execute() function in the scripting engine allows execution of arbitrary operating system commands without validation or an allow-list. This enables users with script creation or editing privileges to run commands with the openEQUELLA service account's privileges, leading to a critical security risk.