Apache OFBiz CVE-2026-85627

Requires an authenticated session with any stock, non-administrative OFBiz account (PR:L) and network access to the OFBiz instance. The exact trigger is the updateLayoutImage event, which writes DataResource fields without a permission check; the attacker must create a DataResource, retype it as a FreeMarker (FTL) template that evaluates its own primary key, then use the resulting FreeMarker evaluation to plant an OFBiz Form Widget whose use-when attribute executes unsandboxed Groovy. Affected: Apache OFBiz 24.09 before 24.09.08 (note the broader EUVD range of all versions below 24.09.08). Limiting factors: a valid low-privileged account is mandatory (no fully unauthenticated path), but no administrative rights and no user interaction are needed, so instances with open or loosely controlled self-registration are substantially more exposed.

This is a genuine priority, not a CVSS-inflated paper risk, but it falls short of emergency. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 8.8) is internally consistent with the described mechanism: a network-reachable event, no user interaction, and only a stock non-administrative account (PR:L) needed to reach full OS command execution as the OFBiz process user. The authentication requirement (PR:L, authenticated) is the single biggest mitigating factor and is confirmed both by the vector and the description ('stock non-administrative account'). EPSS is not provided in the input, so exploitation probability cannot be quantified. The vulnerability is NOT on CISA KEV and no PoC or exploit reference appears in the input, so there is no public exploit identified at time of analysis. The vuln.today decision label is 'this_week' (not act_now/emergency), consistent with a high-impact but authenticated flaw that is not yet known to be exploited. The practical risk is highest for OFBiz instances exposed to large or low-trust user populations, where obtaining a stock account is trivial; for instances where accounts are tightly controlled the barrier is meaningfully higher. CWE is labeled CWE-425 (Forced Browsing) in the input, but the description clearly describes Server-Side Template Injection - verify the weakness classification with the vendor.

A remote attacker who holds (or registers) any ordinary non-administrative OFBiz account invokes the updateLayoutImage event, which writes DataResource fields without a permission check, to retype an attacker-created DataResource as a FreeMarker (FTL) template and then plant an OFBiz Form Widget whose use-when attribute runs unsandboxed Groovy, achieving arbitrary OS command execution as the OFBiz process user. No user interaction is required and the chain is deterministic once a low-privileged session exists. No public exploit code is identified in the provided data.