EUVD-2026-30855
GHSA-jqmc-x3rh-92q5
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
PR:L reflects the minimum Ecommerce Customer account required; C:L/I:L consistent with vendor-indicated partial impact and no availability effect.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz.
This issue affects Apache OFBiz: before 24.09.06.
Users are recommended to upgrade to version 24.09.06, which fixes the issue.
Please note that in the updated version, "Data Resource" records with dataTemplateTypeId = "FTL" are no longer supported.
Additionally, in the updated version, the "Ecommerce Customer" security group no longer includes content management grants. Users are advised to remove these permissions from any production site as well.
AnalysisAI
Server-side template injection (SSTI) in Apache OFBiz before 24.09.06 allows attackers with access to the Ecommerce Customer security group to inject malicious FreeMarker (FTL) template expressions via Data Resource records, yielding partial information disclosure and content integrity impact. The root cause is that the platform's Ecommerce Customer role carried content management grants by default, exposing the FTL template rendering engine to insufficiently trusted input. No public exploit has been identified at time of analysis and EPSS probability is very low (0.02%, 7th percentile), though SSVC flags the attack path as automatable once an account is obtained.
Technical ContextAI
CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine) describes the failure to sanitize user-supplied input before it is evaluated by a server-side template engine. In this case, Apache OFBiz used FreeMarker (FTL) as the template engine for 'Data Resource' records (dataTemplateTypeId = 'FTL'). FreeMarker is a Java-based template language capable of executing arbitrary expressions, traversing object graphs, and - in unrestrained configurations - invoking Java reflection chains that can lead to information disclosure or remote code execution. The affected CPE is cpe:2.3:a:apache_software_foundation:apache_ofbiz:*:*:*:*:*:*:*:* covering all versions before 24.09.06. The compounding factor is a permission misconfiguration: the built-in 'Ecommerce Customer' security group included content management grants, meaning any registered storefront customer could create or modify Data Resource records subject to FTL rendering.
RemediationAI
Upgrade Apache OFBiz to version 24.09.06, which resolves the issue by removing support for Data Resource records with dataTemplateTypeId = 'FTL' and stripping content management grants from the Ecommerce Customer security group. See the vendor thread at https://lists.apache.org/thread/3rcrp8bh3x6ovrj5xnc0fm1f0nrn52r0 for details. As an immediate compensating control prior to patching, administrators should manually remove content management permissions from the Ecommerce Customer (and any similarly scoped) security group in the production OFBiz configuration - this was explicitly called out by Apache as a required post-upgrade step for production sites, underscoring that default role permissions are the key attack enabler. Disabling public self-registration on the storefront is an additional mitigation that raises the bar by preventing unauthenticated parties from obtaining a customer account, though it has obvious business impact. Note that the removal of FTL template support in 24.09.06 is a breaking change: any custom content relying on FTL Data Resource records will need to be migrated to alternative template types.
Rejetto HTTP File Server, up to and including version 2.3m, is vulnerable to a template injection vulnerability. Rated c
Invision Community 5.0.0 through 5.0.6 contains an unauthenticated remote code execution vulnerability in the template e
Remote code execution in the WPML WordPress multilingual plugin (versions up to and including 4.6.12) allows Contributor
Server-side template injection in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source allows remote unauthentica
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Rated critical seve
changedetection.io is an open source web page change detection, website watcher, restock monitor and notification servic
A server side template injection vulnerability in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms all
Remote code execution in WGDashboard 4.3.2 and earlier lets authenticated attackers inject Server-Side Template Injectio
Gibbon through 26.0.00 allows /modules/School%20Admin/messengerSettings.php Server Side Template Injection leading to Re
Server-side template injection in the TYPO3 'Powermail' extension lets an anonymous user submit Fluid template syntax th
Code injection in Orval before 8.21.0 lets an attacker-controlled OpenAPI v3 or Swagger v2 specification execute arbitra
Server-side template injection in FOSSBilling versions prior to 0.8.0 allows authenticated administrators to execute arb
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today