{"id":"CVE-2026-94109","title":"openEQUELLA before 2026.1.0 contains an authenticated stored server-side template injection vulnerability in FreemarkerPortletRenderer.renderHtml() that allows any authenticated non-guest user to achieve remote code execution by storing …","summary":"openEQUELLA before 2026.1.0 contains an authenticated stored server-side template injection vulnerability in FreemarkerPortletRenderer.renderHtml() that allows any authenticated non-guest user to achieve remote code execution by storing …","severity":"high","cvss":8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","cwe":["CWE-1336"],"vendor":"openequella","product":"openEQUELLA","affected":["openEQUELLA < 2026.1.0"],"published":"2026-09-20","updated":"2026-09-24","sourceUpdated":"2026-09-24T12:17:13.817","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-94109","references":[{"url":"https://blog.evan.lat/posts/openeq","label":"disclosure@vulncheck.com"},{"url":"https://github.com/openequella/openEQUELLA/commit/d6e165afc986f8a3ed912cdb367d5ad8c1eeab5c","label":"disclosure@vulncheck.com"},{"url":"https://github.com/openequella/openEQUELLA/releases/tag/2026.1.0","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/openequella-authenticated-stored-ssti-via-freemarkerportletrenderer","label":"disclosure@vulncheck.com"},{"url":"https://github.com/openequella/openEQUELLA","label":"disclosure@vulncheck.com"},{"url":"https://github.com/openequella/openEQUELLA/blob/8bd24b1dcf26cc3d74757e6b982fc1971a7d6767/Source/Plugins/Core/com.equella.core/src/com/tle/core/entity/service/impl/AbstractEntityServiceImpl.java#L230-L250","label":"disclosure@vulncheck.com"},{"url":"https://github.com/openequella/openEQUELLA/blob/8bd24b1dcf26cc3d74757e6b982fc1971a7d6767/Source/Plugins/Core/com.equella.core/src/com/tle/web/freemarker/BasicConfiguration.java","label":"disclosure@vulncheck.com"},{"url":"https://github.com/openequella/openEQUELLA/blob/8bd24b1dcf26cc3d74757e6b982fc1971a7d6767/Source/Plugins/Core/com.equella.core/src/com/tle/web/portal/standard/renderer/FreemarkerPortletRenderer.java#L141-L170","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/openequella-before-2026.1.0-remote-code-execution-via-freemarker-template-injection","label":"disclosure@vulncheck.com"}],"tags":["nvd","cve.org","exploit-available"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"total","timestamp":"2026-09-24T11:57:50.540958Z"},"epss":0.00778,"epssPercentile":0.55674,"ingestedAt":"2026-09-20T12:21:05.902Z","slug":"CVE-2026-94109","body":"## Overview\n\nopenEQUELLA before 2026.1.0 contains an authenticated stored server-side template injection vulnerability in FreemarkerPortletRenderer.renderHtml() that allows any authenticated non-guest user to achieve remote code execution by storing a malicious FreeMarker payload through a POST request to the RemotePortletService invoker endpoint. The markup field from stored portlet configuration is passed directly to custFactory.createResult() without a TemplateClassResolver restriction or FreeMarker sandboxing in BasicConfiguration, leaving built-ins such as ?new and freemarker.template.utility.Execute available, causing the payload to execute in the application server process context when any user renders a dashboard containing the affected portlet.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":56,"depthScoreParts":{"impact":44,"likelihood":0.2,"exploitation":12,"ransomware":0},"changes":[{"seq":210111,"id":"CVE-2026-94109","ts":1790253799514,"field":"exploit_available","old":"false","new":"true"},{"seq":209404,"id":"CVE-2026-94109","ts":1790115199226,"field":"cvss","old":"8.8","new":"8"}]}