What is the CVSS score of CVE-2026-31380?

CVE-2026-31380 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-31380?

Yes, a patch is available for CVE-2026-31380. Update the affected software to the latest version immediately.

Apache OFBiz CVE-2026-31380

EUVD-2026-30862 MEDIUM

Improper Neutralization of Special Elements used in an Expression Language Statement (CWE-917)

2026-05-19 apache

GHSA-rxgg-wf6c-ff5j

Code Injection Apache Apache Ofbiz

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

6.5 MEDIUM

Network-reachable EL injection with no auth required per vendor CVSS; partial C and I reflect data disclosure and state manipulation without full system control or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 17:54 vuln.today

Patch available

May 19, 2026 - 11:16 EUVD

CVE Published

May 19, 2026 - 09:24 nvd

UNKNOWN (no severity yet)

CVE Published

May 19, 2026 - 09:24 cve.org

MEDIUM 6.5

DescriptionCVE.org

Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in Apache OFBiz.

This issue affects Apache OFBiz: before 24.09.06.

Users are recommended to upgrade to version 24.09.06, which fixes the issue.

AnalysisAI

Expression Language Injection in Apache OFBiz before 24.09.06 allows remote unauthenticated attackers to inject and evaluate EL expressions through unsanitized application inputs, yielding partial confidentiality and integrity impact on the affected system. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation is network-reachable with no authentication or user interaction, and SSVC classifies the attack as automatable - a meaningful signal given OFBiz's historical exposure to EL-class vulnerabilities. However, real-world urgency is moderated by a very low EPSS score (0.03%, 8th percentile), no public exploit code identified, and no active exploitation reported; vendor patch 24.09.06 is available.

Technical ContextAI

Apache OFBiz is an open-source Java-based enterprise resource planning (ERP) and e-commerce framework developed by the Apache Software Foundation. The vulnerability is classified as CWE-917 (Improper Neutralization of Special Elements used in an Expression Language Statement), meaning user-controlled input is interpolated into a Java EL or similar template expression without adequate sanitization or sandboxing. EL injection is a well-understood injection class in Java web stacks - attackers can craft inputs that resolve objects, call methods, or traverse the context-accessible object graph at evaluation time. The CPE string 'cpe:2.3:a:apache_software_foundation:apache_ofbiz:*:*:*:*:*:*:*:*' with wildcard version confirms all OFBiz releases prior to 24.09.06 are within scope. OFBiz's Groovy/Freemarker/BeanShell scripting infrastructure and its extensive use of EL in view and controller layers makes it a historically recurring target for this vulnerability class.

RemediationAI

The primary remediation is to upgrade Apache OFBiz to version 24.09.06 or later, which is explicitly identified as the fix release by the vendor. The upgrade advisory is available at https://lists.apache.org/thread/v2brvq1tf4q491obkxv8p7fc5qfshc08. If immediate patching is not feasible, consider restricting external network access to OFBiz endpoints that accept dynamic expression input, particularly control and view layer endpoints that process user-supplied parameters - this reduces automatable external exploitation but does not eliminate insider or authenticated risk. Input validation at the application boundary (rejecting strings containing EL syntax markers such as '${', '#{') can serve as a temporary compensating control, with the trade-off that overly aggressive filtering may break legitimate OFBiz functionality. Deploying a web application firewall rule to detect common EL injection payloads provides an additional detection and blocking layer, though WAF bypass is a known risk for determined attackers. No additional workarounds beyond upgrading are specified in vendor communications.