Authenticated attackers can achieve remote code execution in openEQUELLA versions prior to 2026.1.0 by exploiting an unsandboxed FreeMarker template configuration.

This vulnerability is a template injection flaw (CWE-1336) caused by an insecure FreeMarker configuration. Authenticated users with access to collection summaries, dashboard portlets, or MIME templates can inject malicious expressions to invoke system-level commands through the Java runtime.

Successful exploitation of this vulnerability permits an attacker to execute arbitrary code with the privileges of the application process. Given the CVSS score of 8.8, this represents a high risk to the confidentiality, integrity, and availability of the system. An attacker could gain full control over the server, leading to unauthorized data access, lateral movement within the network, and potential compromise of connected institutional data.

Immediate Action: Upgrade to openEQUELLA version 2026.1.0 or later immediately to apply the necessary template sandboxing configuration.

Proactive Monitoring: Review application logs for suspicious activity related to template rendering, such as unexpected calls to internal utility classes or unusual system command execution patterns.

Compensating Controls: Implement strict input validation or restrict user access to features that allow the creation of custom templates or dashboard portlets until the update is deployed.

Public Exploit Available: Unknown.

This is a critical vulnerability that enables complete system compromise via remote code execution. Security teams must prioritize upgrading to version 2026.1.0 as the primary method of remediation. If an immediate upgrade is not possible, administrators should limit the ability of non-administrative users to modify templates or dashboard configurations to reduce the risk of exploitation.