{"schema":"threatline.record/2","record":{"id":"CVE-2026-16889","aliases":["GHSA-q2xv-rffq-mj5w"],"summary":"Stored XSS via Pre-Login Notice Image Upload Serves Attacker HTML from Application Origin","details":"In openEQUELLA before 2026.1, the pre-login notice image upload endpoint (PUT /api/preloginnotice/image/{name}) does not validate the type of uploaded files and serves them with a Content-Type derived from the supplied filename. A user holding the EDIT_SYSTEM_SETTINGS permission can upload an HTML file that is then served as text/html from the openEQUELLA origin, resulting in stored cross-site scripting. Unauthenticated exploitation is possible where EDIT_SYSTEM_SETTINGS has been granted to the guest user or everyone.","categories":["Unclassified"],"product":"openEQUELLA","vendor":"Apereo Foundation","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-16889","source_modified_at":"2026-10-29T02:02:13.700Z","fetched_at":"2026-10-29T06:57:17.227585Z","product":"openEQUELLA","vendor":"Apereo Foundation","versions":[{"status":"affected","version":"2019.1","lessThan":"2026.1","versionType":"custom"}],"defaultStatus":"unaffected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-16889","source_modified_at":"2026-10-29T02:02:13.700Z","fetched_at":"2026-10-29T06:57:17.227585Z","package":{"name":"openEQUELLA","ecosystem":null},"version":"2026.1","basis":"first unaffected version stated in the CVE record"}],"cvss":4.8,"severity":"Medium","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-29T01:32:09.466Z","modified_at":"2026-10-29T02:02:13.700Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-16889","fetched_at":"2026-10-29T06:57:17.227585Z","source_modified_at":"2026-10-29T02:02:13.700Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://github.com/openequella/openEQUELLA/security/advisories/GHSA-q2xv-rffq-mj5w","tags":["vendor-advisory"]},{"source":"CVE List","url":"https://openequella.github.io/guides/","tags":["product"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-10-29T01:51:03.808908Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-29T02:02:13.700Z","content_hash":"9cc228dd60abd603b7c64f9fe6f3d0a553e9fdc64a8232d4ccafd59879b7e9ad"}}