Threats tagged 'ghsa-jj9r-xgj6-prvj'

openEQUELLA versions before 2026.1 contain a vulnerability in the pre-login notice image upload endpoint that allows users with EDIT_SYSTEM_SETTINGS permission to upload HTML files without proper type validation. These files are served with a Content-Type based on the filename, enabling stored cross-site scripting (XSS). If the permission is granted to unauthenticated users, exploitation can occur without authentication.