GHSA-555x-f7vj-p9qw

Before openEQUELLA 2026.1, the XML parser used for item metadata does not disable external entity resolution. A user with CREATE_ITEM permission can submit crafted XML to POST /api/item, causing the server to read arbitrary files accessible to the openEQUELLA service or make requests to attacker-specified locations, including cloud instance metadata services.