Apache OFBiz CVE-2026-82910

Exploitation requires reaching a code path where renderLink renders a link whose parameters an attacker can control or influence, because those parameters are compiled as FreeMarker source and thus evaluated server-side. The sources do not describe the exact request path, the specific screen/widget, or whether reaching it requires authentication - this entry, unlike others in the same batch, carries no 'unauthenticated' or 'authenticated' qualifier, so the privilege prerequisite is unverified. Practical limiting factors therefore are: the attacker must supply input that flows into a renderLink link parameter, and must be able to reach the relevant OFBiz screen in a deployment running a version prior to 24.09.08; the trigger is not further described in the available sources.

Signals for CVE-2026-82910 are largely absent: the input provides no CVSS score or vector (N/A), no CWE, no EPSS probability, no CISA KEV listing, and no PoC/exploit reference - the vuln.today Decision label is explicitly 'awaiting_data'. What is known is the mechanism implied by the title: renderLink compiles link parameters as FreeMarker source, which is a server-side template injection (FreeMarker SSTI) class issue that typically yields remote code execution in the application's context. That class normally warrants high priority, and Apache OFBiz has a track record of RCE flaws reaching CISA KEV, so this should be treated as a probable high-severity RCE rather than a high-CVSS-but-low-risk issue. However, the authentication boundary is NOT stated: unlike sibling CVEs in the same batch that are explicitly labeled 'Unauthenticated', 'Pre-Authentication', or 'Authenticated', this entry carries no auth qualifier, so privilege requirements cannot be confirmed from the available data. The absence of CVSS, EPSS, and KEV data means severity here is inferred from the bug class and vendor framework, not confirmed - verify with the Apache OFBiz advisory before final prioritization.

An attacker who can influence the link parameters processed by OFBiz's renderLink supplies a FreeMarker expression instead of a plain value; because renderLink compiles those parameters as FreeMarker source, the expression is evaluated server-side and can execute code within the OFBiz process. No public exploit code is identified in the available data, and the exact trigger path and required privilege level are not described in the sources.