Threats tagged 'ghsa-h2p3-9m67-89gr'

openEQUELLA versions prior to 2026.1.0 have an authenticated remote code execution vulnerability. This flaw allows any authenticated non-guest user to execute arbitrary code by exploiting Java deserialization in the HTTP invoker endpoint. The vulnerability arises because attackers can bypass the class-name denylist by nesting a serialized payload inside a java.security.SignedObject, which is deserialized by a separate ObjectInputStream without denylist enforcement, ultimately triggering a JNDI sink that enables code execution.