CVE-2026-85627None▾ SunlitImproper Neutralization of Special Elements Used in a Template Engine ('Server-Side Template Injection') in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only a stock non-administrativ…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Improper Neutralization of Special Elements Used in a Template Engine ('Server-Side Template Injection') in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only a stock non-administrative account to execute arbitrary operating system commands as the OFBiz process user, by using the updateLayoutImage event, which writes DataResource fields with no permission check, to retype an attacker-created DataResource as an FTL template evaluating its own primary key, then using the resulting FreeMarker evaluation to plant an OFBiz Form Widget whose use-when attribute runs unsandboxed Groovy. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
apache_ofbiz < 24.09.08Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-82910High· 8.8Apache OFBiz: renderLink compiles link parameters as FreeMarker source
CVE-2026-100168NoneApache OFBiz: Missing Authorization vulnerability
CVE-2026-105325NoneApache OFBiz: Missing authorization in payment application services allows view-only users to modify payment allocations
CVE-2026-105461NoneApache OFBiz: Missing authorization in updateOrderItems allows view-only users to modify order prices and quantities
CVE-2026-109856NoneApache OFBiz: Missing Authorization in Financial Account Services Enables Unauthorized Balance Manipulation
CVE-2026-114235NoneApache OFBiz: Direct Request in Order Manager Enables Unauthorized Tracking Number Modification