openEQUELLA versions before 2026.1 expose the system.execute() function in the scripting engine to caller‑supplied operating system commands without validation or an allow‑list. An attacker who can create or edit scripts can invoke arbitrary system commands running with the privileges of the openEQUELLA service account, resulting in full remote code execution on the host. This flaw directly maps to the CWE-749 (Execute Access to a Subprocess) and CWE-78 (OS Command Injection) weaknesses.

The affected product is Apereo Foundation openEQUELLA, any release earlier than 2026.1. No specific patch release numbers are stated, but the vendor recommends upgrading to the latest available version to remove the vulnerable code.

The vulnerability carries a CVSS score of 9.4, indicating a critical severity. The EPSS score is not available, and the flaw is not listed in CISA’s KEV catalog. The likely attack path requires an authenticated user with script‑creation or editing rights; once such privileges are obtained, the attacker can trigger remote code execution immediately. Because the flaw allows arbitrary system commands to run as the service account, the impact extends to confidentiality, integrity, and availability of the entire host. The lack of an exploit limit increases the risk of widespread exploitation once a user gains the necessary access.