In openEQUELLA versions before 2026.1, a pre‑login notice image upload endpoint does not validate the file type of uploaded content and derives the response Content‑Type from the supplied filename. A user who has the EDIT_SYSTEM_SETTINGS permission can upload an HTML file that is then served with a text/html Content‑Type from the same origin, enabling attackers to store malicious scripts that run in the browsers of any user who views the pre‑login notice. This flaw provides stored client‑side code execution, which can lead to theft of credentials, session hijacking, or further exploitation within the victim’s session. Unauthenticated exploitation is possible when EDIT_SYSTEM_SETTINGS permission is granted to the guest or everyone role, widening the attack surface to all visitors.

Apereo Foundation openEQUELLA, versions prior to 2026.1. The vulnerability specifically targets the pre‑login notice image upload endpoint (PUT /api/preloginnotice/image/{name}) utilized in those releases.

The CVSS score of 4.8 indicates a moderate severity; however, because the flaw can be triggered remotely via an HTTP request and potentially abused by unauthenticated users if permissions are misconfigured, the business impact may be significant. The EPSS score is not available, and the vulnerability is not yet listed in the CISA KEV catalog, which suggests no widely known public exploits as of this writing. The likely attack vector requires the ability to send a crafted PUT request to the upload endpoint, which can be performed over the public Internet if the openEQUELLA instance is exposed. An attacker could hijack web sessions or conduct phishing attacks by injecting malicious script into the notice image.