EUVD-2026-36167
GHSA-862q-5rrg-cc9p
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable web app (AV:N), no special timing or config (AC:L), requires an authenticated content-editor role (PR:L), no victim interaction (UI:N), full RCE on the JVM yields C/I/A:H.
Primary rating from Vendor (CNA).
CVSS VectorVendor
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
6Description PRE-NVD
Articles & Coverage 2
AnalysisAI
Server-side template injection in Apache OFBiz before 24.09.07 allows authenticated users holding Content or DataResource editing privileges to inject template code that is rendered by the framework, resulting in remote code execution on the application server. The flaw is rated CVSS 8.8 with publicly available exploit code exists via the oss-security disclosure thread, though EPSS sits at 0.09% (26th percentile), indicating broad opportunistic exploitation has not yet been observed. Apache has shipped a fix in 24.09.07 and recommends immediate upgrade.
Technical ContextAI
Apache OFBiz is an open-source enterprise resource planning (ERP) and e-commerce suite built on Java that uses an internal templating engine (FreeMarker/Groovy-based screen and form widgets) to render Content and DataResource entities. The Content/DataResource subsystem stores user-editable templates in the database and renders them through the framework's screen renderer, which historically has been a recurring attack surface in OFBiz (CVE-2023-49070, CVE-2023-51467, CVE-2024-45195 all involved similar template/script execution paths). CWE-94 (Improper Control of Generation of Code) here means input supplied through Content or DataResource editing screens is incorporated into a template that is later evaluated server-side without sufficient sandboxing, allowing FreeMarker or Groovy directives to break out and reach the underlying JVM.
RemediationAI
Vendor-released patch: Apache OFBiz 24.09.07 - upgrade immediately following the migration guidance at https://ofbiz.apache.org/ and the announcement thread https://lists.apache.org/thread/trr2p4zokg54glqlhjnglt4yr7n8t5xd. If an upgrade cannot be applied immediately, restrict Content and DataResource editing privileges to a minimal, trusted set of accounts through OFBiz's security group permissions (revoke CONTENTMGR_CREATE/UPDATE and DATARESOURCE_CREATE/UPDATE from non-essential roles), disable any self-service or default seed users that may carry these permissions, and place the OFBiz web tier behind a reverse proxy that blocks access to /content, /contentmgr, and /webtools template editing endpoints from the Internet - accepting that this will break legitimate content editing workflows for blocked users. Monitor application logs for unusual FreeMarker/Groovy error traces from the screen renderer as a detection compensating control.
Incorrect Authorization vulnerability in Apache OFBiz.12.14. Rated critical severity (CVSS 9.8), this vulnerability is r
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz.12.13. Rate
The vulnerability permits attackers to circumvent authentication processes, enabling them to remotely execute arbitrary
Pre-auth RCE in Apache Ofbiz 18.12.09. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, n
Apache OFBiz has unsafe deserialization prior to 17.12.06. Rated critical severity (CVSS 9.8), this vulnerability is rem
Server-Side Request Forgery (SSRF), Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OF
Apache OFBiz has unsafe deserialization prior to 17.12.07 version. Rated critical severity (CVSS 9.8), this vulnerabilit
Apache OFBiz has unsafe deserialization prior to 17.12.07 version An unauthenticated user can perform an RCE attack. Rat
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz.12.14. Rate
XML-RPC request are vulnerable to unsafe deserialization and Cross-Site Scripting issues in Apache OFBiz 17.12.03. Rated
Apache OFBiz 12.04.x before 12.04.06 and 13.07.x before 13.07.03 allow remote attackers to execute arbitrary commands vi
Direct Request ('Forced Browsing') vulnerability in Apache OFBiz.12.16. Rated high severity (CVSS 7.5), this vulnerabili
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today