Apache OFBiz CVE-2026-82960

Requires an authenticated session with CMS content-editor access to the OFBiz cms plugin (confirmed by PR:L). The exact trigger is a POST to the EditAddContent handler with a crafted caContentIdTo parameter, which the CMS screen copies into a top-level context variable interpolated into a form field's use-when attribute and passed to GroovyUtil.eval(); the payload closes the expanded string literal and reaches java.lang.Runtime via reflection, which the compile-time SecureASTCustomizer sandbox does not restrict at runtime. Limiting factor: the cms plugin must be deployed and the attacker must possess valid content-editor credentials - no user interaction is needed and the request is a single POST, so there is no additional complexity barrier. Affects Apache OFBiz versions before 24.09.08 on all platforms.

This is a genuine high-priority issue rather than an inflated CVSS score. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) is internally consistent with the description: remote, low-complexity, no user interaction, requiring only low-privilege CMS content-editor access, yielding full C:H/I:H/A:H impact because the flaw results in arbitrary OS command execution as the OFBiz process user. The vuln.today decision label is 'this_week' (not act_now/emergency), which aligns with the absence of a CISA KEV listing and no supplied EPSS score. No public exploit code or PoC reference is present in the input - only vendor and oss-security advisory links - so this is not confirmed as actively exploited. The combination of trivial exploitation mechanics (a single crafted HTTP POST) and full RCE impact is offset by the privilege prerequisite: an attacker must already hold a valid CMS content-editor account, which narrows the realistic attacker population to insiders or anyone who has obtained such credentials. EPSS and KEV data are both missing/absent; absence of KEV is not evidence against the severity, but it does mean there is no confirmation of in-the-wild activity. Net: patch within the vendor/priority window, treating any environment with externally reachable or loosely-provisioned CMS editor accounts as elevated risk.

An attacker who holds (or has phished/obtained) a low-privilege OFBiz CMS content-editor account sends a single HTTP POST to EditAddContent with a crafted caContentIdTo value. Because that parameter is copied into a top-level context variable and interpolated into a form field's use-when attribute, the payload closes the expanded string literal and invokes java.lang.Runtime via reflection through GroovyUtil.eval(), running arbitrary OS commands as the OFBiz process user. No public exploit code is identified in the provided sources at time of analysis.