CVE-2026-66088EUVD-2026-112564
Unrestricted Command Execution via system.execute
- Published
- Last modified
- Status
- published
- Known exploitation
- Not listed in CISA KEV
- Fix
- Fixed in 2026.1
- Public exploit
- None on Exploit-DB, Metasploit or GitHub
CISA SSVC
- Exploitation: none
- Automatable: no
- Technical impact: total
?
Decision points from CISA's Vulnrichment, assessed (SSVC 2.0.3).
SSVC documentationSummary
openEQUELLA, an open-source learning content management platform, is affected. An attacker who can create or edit scripts can run arbitrary operating system commands with the privileges of the openEQUELLA service account.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
In openEQUELLA before 2026.1, the system.execute() function available to the scripting engine runs supplied operating system commands without validation or an allow-list of permitted executables. A user able to create or edit scripts can use it to execute arbitrary commands with the privileges of the openEQUELLA service account.
Affected versions
- Apereo Foundation openEQUELLA
fixed in 2026.1