Description

openEQUELLA versions before 2026.1.0 contain a remote code execution vulnerability in FreeMarker template compilation due to an unsandboxed TemplateClassResolver configuration. Authenticated attackers can inject malicious template expressions through collection summaries, dashboard portlets, or MIME templates to instantiate dangerous classes like freemarker.template.utility.Execute and invoke Runtime.exec for arbitrary command execution.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-20T12:17:06.620Z",
  "pubdate": "2026-09-20T12:17:06.620Z",
  "executiveSummary": "This vulnerability is a Remote Code Execution (RCE) flaw residing in the FreeMarker template engine configuration within openEQUELLA versions prior to 2026.1.0.\nThe issue stems from the improper implementation of TemplateClassResolver, which fails to restrict the instantiation of sensitive Java classes within templates.\nAuthenticated attackers can leverage this misconfiguration to inject malicious template expressions, leading to the execution of arbitrary system commands with the privileges of the application process.\nThe attack surface includes any application feature that renders user-supplied templates, specifically collection summaries, dashboard portlets, and MIME-based templates.\nSuccessful exploitation results in a full system compromise, allowing attackers to execute arbitrary code, manipulate sensitive data, or move laterally within the infrastructure.\nThe primary risk implication is total loss of confidentiality, integrity, and availability of the affected openEQUELLA instance.\nExploitation requires authenticated access, though the level of privilege required is often reachable via standard user accounts capable of interacting with customizable dashboard portlets or collection configurations.",
  "technicalDetails": "The root cause of the vulnerability is an insecure configuration of the FreeMarker TemplateClassResolver. In FreeMarker, the TemplateClassResolver is responsible for resolving Java classes referenced within a template. When not explicitly configured for security, the default behavior can allow the resolution of arbitrary classes on the classpath.\nIn openEQUELLA, the application environment fails to enforce a restricted class resolution policy. Consequently, the FreeMarker engine permits the instantiation of utility classes that are not intended for template-level interaction.\nAn authenticated attacker can exploit this by crafting a malicious FreeMarker template expression. Specifically, the attacker targets the instantiation of the 'freemarker.template.utility.Execute' class. This class provides a mechanism to invoke operating system commands via 'Runtime.exec()'.\nThe attack flow begins when an attacker accesses an input field that supports template processing, such as a dashboard portlet configuration, collection summary description, or a MIME template definition. By injecting a template directive like '<@assign x=\"freemarker.template.utility.Execute\"?new() />' followed by a call to the object with a system command string, the attacker triggers the execution of that command on the underlying host server.\nBecause the TemplateClassResolver is unsandboxed, there is no validation logic to prevent the template engine from reaching critical Java runtime classes. The payload executes in the context of the openEQUELLA application server process. If the application is running with elevated service permissions, the attacker inherits those permissions, effectively gaining full control over the host.\nThe vulnerability is present in all versions prior to 2026.1.0. Exploitation is possible through any interface where user-controlled content is rendered by the FreeMarker engine. This effectively transforms a content-injection vulnerability into a full-system Remote Code Execution (RCE) primitive.\nPost-exploitation, the attacker can execute system binaries, install web shells, exfiltrate the application database, or interact with backend internal networks from the compromised host, significantly escalating the impact of an initially authenticated session."
}