CVE-2026-94109 openEQUELLA < 2026.1.0 Authenticated Stored SSTI via FreemarkerPortletRenderer

openEQUELLA before 2026.1.0 contains an authenticated stored server-side template injection vulnerability in FreemarkerPortletRenderer.renderHtml that allows any authenticated non-guest user to achieve remote code execution by storing a malicious FreeMarker payload through a POST request to the...

CVE-2026-94109: Improper Neutralization of Special Elements Used in a Template Engine

openEQUELLA before 2026.1.0 contains an authenticated stored server-side template injection vulnerability in FreemarkerPortletRenderer.renderHtml that allows any authenticated non-guest user to achieve remote code execution by storing a malicious FreeMarker payload through a POST request to the...