CVE-2026-85627
HIGH
MEDIUM
Priority: 0.04
BB Relevance:
68/100
Published: 2026-11-05
Modified: 2026-11-06
First seen: 2026-11-05
Status: active
Attack Surface
Network
Low Complexity
No Interaction
Conf. Impact
Integ. Impact
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
Low
UI:
None
S:
Unchanged
C:
High
I:
High
A:
High
Description
Improper Neutralization of Special Elements Used in a Template Engine ('Server-Side Template Injection') in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only a stock non-administrative account to execute arbitrary operating system commands as the OFBiz process user, by using the updateLayoutImage event, which writes DataResource fields with no permission check, to retype an attacker-created DataResource as an FTL template evaluating its own primary key, then using the resulting FreeMarker evaluation to plant an OFBiz Form Widget whose use-when attribute runs unsandboxed Groovy. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
Weakness Classification (2)
Affected Software (3)
| Vendor | Product | Version |
|---|---|---|
| Apache Software Foundation | Apache OFBiz | 0 < 24.09.08 |
| Apache Software Foundation | Apache OFBiz | 0 < 24.09.08 |
| Apache Software Foundation | Apache OFBiz | 0 < 24.09.08 |
References & Advisories (1)
vendor-advisory