CVE-2026-66090 XML External Entity (XXE) Injection in Metadata Field Allows Arbitrary File Read

In openEQUELLA before 2026.1, the XML parser used for item metadata does not disable external entity resolution. A user permitted to create items CREATEITEM can submit crafted XML to POST /api/item and cause the server to read arbitrary files accessible to the openEQUELLA service, or make request...