External risk intelligence

openEQUELLA Scripting Command Execution Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.4)

CVE-2026-66088

openEQUELLA is a digital repository platform that can be internet-facing, but this specific vulnerability requires an authenticated user with permissions to create or edit scripts. While the application may be accessible from the internet, the exploit requires a privileged user account rather than being a pre-authentication endpoint or an inherently public-facing gateway service.

OS Command Injection

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

An issue has been identified in openEQUELLA, a digital repository platform, where a scripting function allows for the execution of operating system commands without proper validation. This means a user with the ability to edit scripts could potentially run unauthorized commands on the system, using the privileges of the service account under which openEQUELLA operates.

Scripts can run unauthorized commands.
Confirms potential for system compromise.
Assess relevance and exposure to operations.

Attack Path

How an attacker could exploit the issue

An attacker with the ability to create or edit scripts within openEQUELLA can leverage the `system.execute()` function to run unauthorized operating system commands. This occurs because the function does not validate or restrict the executables that can be called. Successful exploitation allows the attacker to execute commands with the same permissions as the openEQUELLA service account.

Authenticated user with script creation/editing privileges.
Use of the `system.execute()` scripting function.
Arbitrary command execution with service account privileges.

Live Threat

Current exploitation, exposure, and threat context

In openEQUELLA before 2026.1, the system's scripting engine could be tricked into running operating system commands chosen by a user with script editing privileges. This could occur when a user with the ability to create or modify scripts exploits the system.execute() function, allowing arbitrary command execution under the openEQUELLA service account's permissions.

System commands executed.
Malicious scripts are uploaded.
Service account privileges compromised.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability requires an authenticated user with script creation privileges, making it most relevant to teams responsible for the openEQUELLA application and its underlying infrastructure. The immediate first step is to confirm the presence and accessibility of the affected openEQUELLA instances, identify their business criticality, and pinpoint the accountable system owner to initiate a coordinated risk-based remediation plan.

Own the issue: Application owners.
Verify first: Scripting function reachability.
Action: Plan remediation and vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is openEQUELLA?

openEQUELLA is a digital repository platform used by institutions to manage, store, and discover diverse learning and research content. It functions as a centralized hub where users can organize resources, manage workflows, and collaborate on educational materials. Because it handles significant volumes of institutional data, it often integrates into wider network environments to support access for students, faculty, and administrative staff.

What is the vulnerability in CVE-2026-66088?

This vulnerability is an instance of OS Command Injection (CWE-78). The system.execute() function in the platform's scripting engine lacks necessary security controls, such as an allow-list, to verify commands before they run. This flaw permits the software to execute arbitrary system-level commands provided by a user, effectively bypassing intended functional boundaries and allowing the script to perform unauthorized actions.

How is this command execution triggered?

An attacker must have legitimate permissions to create or edit scripts within the openEQUELLA environment to trigger this bug. The vulnerability is not a public-facing flaw that runs automatically; it specifically requires the misuse of the system.execute() function by an authenticated user. Actions that do not involve the scripting engine, or interactions by users who lack script management privileges, will not activate this specific command injection path.

Why does Halo Surface Signal categorize this as possible?

Halo Surface Signal labels this as 'Possible' because, while an openEQUELLA instance might be reachable over the internet, the vulnerability is not exploitable by anonymous visitors. Successful exploitation requires an authenticated account with specific privileges to modify scripts. Therefore, the threat is localized to the platform's internal management capabilities rather than being an issue accessible to any internet user who reaches the login page.

What steps should I take if I run openEQUELLA?

First, identify all instances of openEQUELLA in your environment and determine their business criticality. Review who has administrative or scripting privileges, as these are the primary accounts of concern. Coordinate with your system owners to audit existing scripts for unauthorized entries. Finally, check for updates, as the vulnerability is resolved in versions 2026.1 and later, and plan for a controlled upgrade to mitigate the risk.

References

openequella.github.io/guides/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.