CVE-2026-16889 Details
Description
In openEQUELLA before 2026.1, the pre-login notice image upload endpoint (PUT /api/preloginnotice/image/{name}) does not validate the type of uploaded files and serves them with a Content-Type derived from the supplied filename. A user holding the EDIT_SYSTEM_SETTINGS permission can upload an HTML file that is then served as text/html from the openEQUELLA origin, resulting in stored cross-site scripting. Unauthenticated exploitation is possible where EDIT_SYSTEM_SETTINGS has been granted to the guest user or everyone.
A stored cross-site scripting vulnerability has been identified in openEQUELLA versions 2019.1 prior to 2026.1.0. The issue arises in the pre-login notice image upload endpoint, which fails to validate the type of uploaded files. This allows users with the EDIT_SYSTEM_SETTINGS permission to upload HTML files, which are then served as text/html from the openEQUELLA origin. As a result, any scripts contained in the HTML file are executed as first-party content in the browser of anyone who accesses the file's URL. The vulnerability can be exploited without authentication if the EDIT_SYSTEM_SETTINGS permission is granted to the guest user or everyone.
Users can upgrade to openEQUELLA version 2026.1.0 or later, where this vulnerability is fixed. After upgrading, confirm that the EDIT_SYSTEM_SETTINGS permission is not granted to the guest user or everyone. For those unable to upgrade, the vulnerability can be mitigated by blocking PUT requests to the pre-login notice image upload endpoint at a reverse proxy or web application firewall.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 29, 2026CISA-ADP
Assessed Oct 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/openequella/openEQUELLA/security/advisories/GHSA-q2xv-rffq-mj5w | MON-CSIRT | AdvisoryRemedyVendor |
| https://openequella.github.io/guides/ | MON-CSIRT | Vendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-434 | Unrestricted Upload of File with Dangerous Type | MON-CSIRT |
Affected Products
| Product | Versions |
|---|---|
| openEQUELLA | >= 2019.1, < 2026.1.0 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 29, 2026 | CVE Modified | CISA-ADP |
| Oct 29, 2026 | New CVE Received | MON-CSIRT |