CVE-2026-66088
UNKNOWN
NVD
CVSS Score
0
Severity
UNKNOWN
Published
Oct 29, 2026
Vendor
unknown
Description
In openEQUELLA before 2026.1, the system.execute() function available to the scripting engine runs supplied operating system commands without validation or an allow-list of permitted executables. A user able to create or edit scripts can use it to execute arbitrary commands with the privileges of the openEQUELLA service account.