EUVD-2026-30860
GHSA-vrqp-r2f3-7qfj
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network-delivered XSS requires no privileges but mandates user interaction; scope change reflects cross-origin browser impact; no availability impact applies.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz.
This issue affects Apache OFBiz: before 24.09.06.
Users are recommended to upgrade to version 24.09.06, which fixes the issue.
AnalysisAI
Cross-site scripting, path traversal, and code injection vulnerabilities in Apache OFBiz before version 24.09.06 expose unauthenticated network attackers to the ability to inject malicious scripts into web pages rendered by authenticated users, with the scope change (S:C) in the CVSS vector indicating cross-origin impact such as session hijacking. The co-presence of path traversal and code injection primitives alongside XSS suggests potential for chained exploitation beyond a standard reflected XSS attack, though SSVC rates current exploitation as none and EPSS sits at 0.03% (9th percentile), indicating very low real-world exploitation probability at time of analysis. No public exploit code and no active exploitation (KEV) have been identified; vendor-released patch 24.09.06 is available.
Technical ContextAI
Apache OFBiz is an open-source Java-based enterprise resource planning (ERP) framework widely used in manufacturing, e-commerce, and retail verticals, covering inventory, accounting, and order management. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), reflecting insufficient input sanitization before rendering user-controlled data into HTML responses. The co-listed weaknesses - path traversal (CWE-22) and code injection (CWE-94) - suggest that the same unsanitized input pathways can be manipulated to escape restricted directories or inject executable code fragments, potentially via OFBiz's Groovy-based scripting engine or Freemarker template layer. The CPE cpe:2.3:a:apache_software_foundation:apache_ofbiz:*:*:*:*:*:*:*:* covers all versions of the application without platform restriction.
RemediationAI
The primary fix is upgrading Apache OFBiz to version 24.09.06, as recommended by the Apache Software Foundation in their advisory at https://lists.apache.org/thread/1tcnkxjm0s6n1ohfb21brl25dt0hv9by. For deployments where immediate upgrade is not feasible, consider restricting public internet access to OFBiz endpoints using a WAF rule that blocks requests containing path traversal sequences (e.g., ../) and common XSS payloads in URL parameters and POST bodies - note that WAF coverage of code injection via template engines is imperfect and should not substitute patching. Additionally, placing OFBiz behind an authenticated reverse proxy can mitigate the PR:N attack vector by requiring prior authentication before reaching the vulnerable endpoints, though this introduces user friction for legitimate external access. The Openwall oss-security thread at http://www.openwall.com/lists/oss-security/2026/05/19/18 may contain additional technical detail to inform interim mitigations.
More in Apache Ofbiz
View allRemote code execution in Apache OFBiz before 24.09.06 stems from an improper authentication flaw in the password-change
LDAP injection in Apache OFBiz before 24.09.06 allows remote unauthenticated attackers to inject special characters into
Sensitive data exposure and integrity compromise in Apache OFBiz before 24.09.06 stems from a hard-coded cryptographic k
Authenticated code injection in Apache OFBiz versions prior to 24.09.06 allows remote attackers with low-privileged acco
Information disclosure in Apache OFBiz before 24.09.06 lets remote unauthenticated attackers retrieve sensitive data the
Server-Side Request Forgery in Apache OFBiz before 24.09.06 allows remote unauthenticated attackers to coerce the server
Server-Side Request Forgery in Apache OFBiz before 24.09.06 allows remote unauthenticated attackers to coerce the server
Improper input validation in Apache OFBiz before 24.09.06 allows unauthenticated remote attackers to achieve partial con
Code injection in Apache OFBiz's email services exposes all versions before 24.09.06 to unauthenticated remote exploitat
Expression Language Injection in Apache OFBiz before 24.09.06 allows remote unauthenticated attackers to inject and eval
Server-side template injection (SSTI) in Apache OFBiz before 24.09.06 allows attackers with access to the Ecommerce Cust
Path traversal in Apache OFBiz before 24.09.06 exposes unauthenticated remote attackers to file read and limited file wr
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today