What is GHSA-93f7-2j6h-9wwg?

GHSA-93f7-2j6h-9wwg is a security advisory published by GitHub Security Advisories with Medium severity. In openEQUELLA before 2026.1, the SOAP API parses XML supplied in the stopEdit operation with a...

Which CVE IDs does GHSA-93f7-2j6h-9wwg cover?

GHSA-93f7-2j6h-9wwg covers the following CVE IDs: CVE-2026-66089. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

GHSA-93f7-2j6h-9wwgMedium

In openEQUELLA before 2026.1, the SOAP API parses XML supplied in the stopEdit operation with a...

Vendor

GitHub Security Advisories

Published

October 29, 2026

Last Modified

October 29, 2026

🔗 CVE IDs covered (1)

CVE-2026-66089 →

📋 Description

In openEQUELLA before 2026.1, the SOAP API parses XML supplied in the stopEdit operation with a parser that resolves external entities. This allows an attacker to read arbitrary files accessible to the openEQUELLA service or cause the server to issue requests to attacker-specified locations (SSRF).

🔗 References (4)

https://github.com/openequella/openEQUELLA/security/advisories/GHSA-f9wv-5rpf-rq45
https://nvd.nist.gov/vuln/detail/CVE-2026-66089
https://openequella.github.io/guides
https://github.com/advisories/GHSA-93f7-2j6h-9wwg