XML External Entity (XXE) Vulnerability in SOAP Interface Allows External Entity Expansion
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 2026.1
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: partial
Summary
openEQUELLA, a software platform for managing digital content and learning resources, is affected through its SOAP interface. An attacker could exploit this flaw to read files the service can access on the server or make the server send requests to locations of the attacker's choosing.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
In openEQUELLA before 2026.1, the SOAP API parses XML supplied in the stopEdit operation with a parser that resolves external entities. This allows an attacker to read arbitrary files accessible to the openEQUELLA service or cause the server to issue requests to attacker-specified locations (SSRF).
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- Apereo Foundation openEQUELLA
fixed in 2026.1