Apache OFBiz CVE-2026-29207

Exploitation requires the attacker to hold an active Ecommerce Customer account (or equivalent) on the target OFBiz instance, because the attack path flows through the content management grants that were - prior to 24.09.06 - included in that security group by default. The FTL template rendering path is only triggered when Data Resource records with dataTemplateTypeId = 'FTL' are present or can be created, meaning the feature must be accessible to the customer role. If the OFBiz deployment disables public self-registration, the attacker would need to obtain credentials through other means, significantly raising the bar. Exploitation is further limited to OFBiz deployments that have not already manually removed content management permissions from customer-facing roles. There is no indication this requires a specific OS, database, or hosting environment.

The vendor-assigned CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) overstates the privilege-free nature of exploitation: the description implies at minimum a registered Ecommerce Customer account is required, suggesting PR:L is more accurate than PR:N. The C:L/I:L/A:N impact metrics appear conservative for SSTI - FreeMarker SSTI has historically been chained to full RCE in other frameworks - but the vendor's CVSS and the 'Information Disclosure' tag suggest sandboxing or contextual limits reduce the worst-case outcome here. EPSS at 0.02% (7th percentile) signals negligible observed exploitation interest, consistent with SSVC's 'Exploitation: none' and the absence of KEV listing. SSVC's 'Automatable: yes' is the primary risk amplifier: once an attacker has a customer account, the injection path requires no complex setup. The gap between the automatable SSVC signal and the very low EPSS suggests the attack is theoretically automatable but not yet operationalized in the wild. This is a real but non-urgent priority for most deployments - highest concern for publicly accessible OFBiz storefronts with open customer self-registration.

An attacker registers a customer account on a publicly accessible Apache OFBiz storefront (or obtains one through social engineering). Leveraging the content management grants inherited by the Ecommerce Customer group, the attacker creates or edits a Data Resource record with dataTemplateTypeId = 'FTL', embedding a malicious FreeMarker expression such as a directive to expose server-side variables or traverse the Java object graph. When the record is rendered by the template engine, the injected expression executes server-side, leaking sensitive configuration data or manipulating output returned to the attacker or other users. No public proof-of-concept has been identified at time of analysis.