# CVE-2026-16889: openEQUELLA stored XSS in pre-login notice image upload

Source: https://junglewise.ai/threats/cve-2026-16889-in-openequella-before-2026-1-the-pre-login-notice-image-upload  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-29. Updated: 2026-10-29  
License: CC BY 4.0 with a link back

CVE-2026-16889 · Severity: info · Published 2026-10-29

openEQUELLA is a digital asset management system used by educational and research institutions. An attacker with system settings permissions can upload an HTML file through the pre-login notice feature, which is then served as a webpage and executes malicious scripts in users' browsers. In some configurations where guest access has these permissions, this can be exploited without any authentication.

Technologies: [openEQUELLA](https://junglewise.ai/threats/technologies/openequella). Vendors: [openEQUELLA](https://junglewise.ai/threats/vendors/openequella).

## Quick answers

**Is CVE-2026-16889 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-16889 being exploited in the wild.

**How severe is CVE-2026-16889?** Informational severity, published 29 October 2026.

**Which products and versions are affected?** openEQUELLA before 2026.1.

**Is there a fix for CVE-2026-16889?** Yes: fixed in 2026.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-16889 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-16889?** Check whether you run openEQUELLA at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 2026.1

## Technical details

The PUT /api/preloginnotice/image/{name} endpoint fails to validate uploaded file types and derives the Content-Type header from the supplied filename. An authenticated user with EDIT_SYSTEM_SETTINGS permission can upload an HTML file containing JavaScript, which is stored and served with Content-Type: text/html from the openEQUELLA origin, resulting in stored cross-site scripting. Unauthenticated exploitation is possible if EDIT_SYSTEM_SETTINGS has been granted to guest or all-users groups.

## Affected products

- openEQUELLA openEQUELLA before 2026.1

## References

- [https://github.com/openequella/openEQUELLA/security/advisories/GHSA-q2xv-rffq-mj5w](https://github.com/openequella/openEQUELLA/security/advisories/GHSA-q2xv-rffq-mj5w)
- [https://openequella.github.io/guides/](https://openequella.github.io/guides/)

## Related threats

- [openEQUELLA stored cross-site scripting in login notice](https://junglewise.ai/threats/cve-2026-66092-in-openequella-before-2026-2-the-pre-login-notice-is-stored-as)
- [openEQUELLA authentication bypass in user info endpoint](https://junglewise.ai/threats/cve-2026-66091-in-openequella-before-2026-1-the-get-api-userquery-userinfobackup)
- [openEQUELLA XXE in item metadata XML parser](https://junglewise.ai/threats/cve-2026-66090-in-openequella-before-2026-1-the-xml-parser-used-for-item)
- [openEQUELLA XML external entity injection in SOAP API](https://junglewise.ai/threats/cve-2026-66089-in-openequella-before-2026-1-the-soap-api-parses-xml-supplied-in)
- [openEQUELLA OS command injection in scripting engine](https://junglewise.ai/threats/cve-2026-66088-in-openequella-before-2026-1-the-system-execute-function)