---
id: CVE-2026-94109
title: >-
  openEQUELLA versions before 2026.1.0 contain a remote code execution
  vulnerability in FreeMarker template compilation due to an unsandboxed
  TemplateClassResolver configuration
summary: >-
  openEQUELLA versions before 2026.1.0 contain a remote code execution
  vulnerability in FreeMarker template compilation due to an unsandboxed
  TemplateClassResolver configuration. Authenticated attackers can inject
  malicious template expres…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-1336
vendor: openequella
product: openEQUELLA
affected:
  - openEQUELLA < 2026.1.0
published: '2026-09-20'
updated: '2026-09-20'
sourceUpdated: '2026-09-20T12:17:06.620'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-94109'
references:
  - url: 'https://github.com/openequella/openEQUELLA'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/openequella/openEQUELLA/blob/8bd24b1dcf26cc3d74757e6b982fc1971a7d6767/Source/Plugins/Core/com.equella.core/src/com/tle/core/entity/service/impl/AbstractEntityServiceImpl.java#L230-L250
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/openequella/openEQUELLA/blob/8bd24b1dcf26cc3d74757e6b982fc1971a7d6767/Source/Plugins/Core/com.equella.core/src/com/tle/web/freemarker/BasicConfiguration.java
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/openequella/openEQUELLA/blob/8bd24b1dcf26cc3d74757e6b982fc1971a7d6767/Source/Plugins/Core/com.equella.core/src/com/tle/web/portal/standard/renderer/FreemarkerPortletRenderer.java#L141-L170
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/openequella/openEQUELLA/commit/d6e165afc986f8a3ed912cdb367d5ad8c1eeab5c
    label: disclosure@vulncheck.com
  - url: 'https://github.com/openequella/openEQUELLA/releases/tag/2026.1.0'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/openequella-before-2026.1.0-remote-code-execution-via-freemarker-template-injection
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-20T12:21:05.902Z'
epss: 0.00915
epssPercentile: 0.58098
---

## Overview

openEQUELLA versions before 2026.1.0 contain a remote code execution vulnerability in FreeMarker template compilation due to an unsandboxed TemplateClassResolver configuration. Authenticated attackers can inject malicious template expressions through collection summaries, dashboard portlets, or MIME templates to instantiate dangerous classes like freemarker.template.utility.Execute and invoke Runtime.exec for arbitrary command execution.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.