openEQUELLA versions before 2026.1 have a vulnerability in the SOAP API's stopEdit operation where XML parsing resolves external entities. This flaw enables attackers to read arbitrary files accessible by the service or perform server-side request forgery (SSRF). The vulnerability has a medium severity rating with a CVSS score of 6.1.