openEQUELLA: OS command execution via scripting engine system.execute()
Summary
In openEQUELLA before 2026.1, the scripting function system.execute() runs supplied operating system commands without validation or an allow-list. A user who can create or edit scripts can execute arbitrary commands with the privileges of the openEQUELLA service account, which may allow reading or modifying data and further compromise of the host. The CNA rates the issue Critical (CVSS 4.0 9.4), and authentication with script-edit rights is required.
Affected
- openEQUELLA versions before 2026.1 (0 to < 2026.1)
- Default configuration of 2026.1 and later is not affected
Fixed in
- Upgrade to openEQUELLA 2026.1 or later
- Specific patch-level or build numbers: Unknown.
Workaround
- Restrict script create/edit rights (such as EDIT_COLLECTION) to administrators and trusted collection managers; do not grant them to the Everyone group or guest users
- Run the openEQUELLA service account with minimum operating system privileges
- Vendor-confirmed workaround beyond these measures: Unknown.
Exploitation
- No evidence of exploitation found; not listed in CISA KEV.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
- No public proof-of-concept indexed; exploit details not published by the vendor.
Our recommendation
- Upgrade openEQUELLA to 2026.1 or later; this also addresses related advisories published the same day.
- Review which accounts hold script create/edit rights and remove unnecessary grants.
- Check whether the openEQUELLA service is internet-facing.
- Review existing scripts for unexpected system.execute() calls and monitor the server for unusual child processes or outbound connections.
- After upgrading, add only required executables to system.execute.allowedExecutables; do not allow shells or interpreters.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-q8xp-w3fr-hj4v github.com
- openEQUELLA Administrative and User Guides openequella.github.io
- VulDB CVE-2026-66088 vuldb.com
- Strix CVE-2026-66088 www.strix.ai
- OffSeq Radar CVE-2026-66088 radar.offseq.com
- ThreatINT CVE-2026-66088 cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 23:41.
Original description (NVD)
In openEQUELLA before 2026.1, the system.execute() function available to the scripting engine runs supplied operating system commands without validation or an allow-list of permitted executables. A user able to create or edit scripts can use it to execute arbitrary commands with the privileges of the openEQUELLA service account.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.