Executive brief
openEQUELLA is a digital repository system used by universities to store and manage media content and library materials. An authenticated user can inject malicious FreeMarker template code through portlet configuration that executes with server privileges when any user views a dashboard, leading to complete system compromise and remote code execution.
Technical details
A stored server-side template injection vulnerability exists in FreemarkerPortletRenderer.renderHtml() where user-supplied markup from portlet configuration is passed directly to FreeMarker's template engine without TemplateClassResolver restrictions or sandboxing. Any authenticated user can inject FreeMarker payloads via POST requests to RemotePortletService, enabling access to dangerous built-ins like ?new and freemarker.template.utility.Execute that execute in the application server process context.
Affected products
- openEQUELLA openEQUELLA before 2026.1.0
Timeline
- 2026-09-20: disclosed
- 2026-07-23: patched: Fix committed to lock down FreeMarker configuration