CVE-2026-66092

In openEQUELLA before 2026.2, the pre-login notice is stored as HTML and rendered on the legacy logon page without encoding or sanitisation. A user holding the EDITSYSTEMSETTINGS permission can set a notice containing an arbitrary script PUT /api/preloginnotice, resulting in stored cross-site...

CVE-2026-16889

In openEQUELLA before 2026.1, the pre-login notice image upload endpoint PUT /api/preloginnotice/image/name does not validate the type of uploaded files and serves them with a Content-Type derived from the supplied filename. A user holding the EDITSYSTEMSETTINGS permission can upload an HTML file...

EUVD-2026-112568

In openEQUELLA before 2026.2, the pre-login notice is stored as HTML and rendered on the legacy logon page without encoding or sanitisation. A user holding the EDITSYSTEMSETTINGS permission can set a notice containing an arbitrary script PUT /api/preloginnotice, resulting in stored cross-site...

CVE-2026-16889 Stored XSS via Pre-Login Notice Image Upload Serves Attacker HTML from Application Origin

In openEQUELLA before 2026.1, the pre-login notice image upload endpoint PUT /api/preloginnotice/image/name does not validate the type of uploaded files and serves them with a Content-Type derived from the supplied filename. A user holding the EDITSYSTEMSETTINGS permission can upload an HTML file...

EUVD-2026-112563

In openEQUELLA before 2026.1, the pre-login notice image upload endpoint PUT /api/preloginnotice/image/name does not validate the type of uploaded files and serves them with a Content-Type derived from the supplied filename. A user holding the EDITSYSTEMSETTINGS permission can upload an HTML file...

CVE-2026-16889

In openEQUELLA versions before 2026.1 , the pre-login notice image upload endpoint (PUT /api/preloginnotice/image/{name} ) fails to validate uploaded file types. This allows a user with the EDIT_SYSTEM_SETTINGS permission to upload an HTML file that the application serves with a text/html Content...