openEQUELLA’s XML parser for item metadata did not disable external entity resolution, allowing an authenticated user with CREATE_ITEM privileges to submit crafted XML to the /api/item endpoint. When processed, the parser resolves external entities, enabling the server to read any file accessible to the openEQUELLA service process and to issue requests to attacker‑specified URLs, including cloud instance metadata services. This constitutes an XML External Entity (XXE) flaw that can disclose arbitrary file contents, compromise credentials, or expose sensitive configuration data.

Apereo Foundation’s openEQUELLA software versions prior to 2026.1 are affected. Any installation that uses the default XML parser for metadata submission and grants item‑creation rights to users is vulnerable.

The CVSS score of 7.1 rates the vulnerability as high, yet the EPSS score is not available, indicating that precise exploitation probability remains uncertain. The flaw is not listed in CISA’s KEV catalog. Exploitation requires that the attacker be authenticated and authorized to create items, which narrows the attack surface to users with CREATE_ITEM rights, but once executed the attack can read arbitrary files and access internal metadata, severely impacting confidentiality and potentially integrity of the system.