Apache OFBiz EUVD-2026-30860

No authentication is required to deliver the malicious payload, as confirmed by CVSS PR:N; however, a victim user must actively interact with a crafted link or page (UI:R), meaning passive exploitation without social engineering is not possible. The scope change (S:C) indicates the XSS payload executes in a browser security context beyond the vulnerable OFBiz component itself. Exploitation is further limited by SSVC Automatable: no, ruling out worm-like mass exploitation. Path traversal and code injection primitives likely require specific endpoint or parameter conditions not fully detailed in available data - the exact feature or route affected is not disclosed in the advisory text. Defenders should verify whether OFBiz is internet-exposed versus internal-only, as internal deployment significantly reduces realistic attacker reach.

The CVSS 6.1 Medium score is driven by network vector, low complexity, no required privileges, but mandatory user interaction (UI:R) and a changed scope (S:C). The UI:R requirement directly aligns with SSVC's Automatable: no - mass automated exploitation is not feasible without a mechanism to trick users into following crafted links. EPSS at 0.03% (9th percentile) corroborates a low near-term exploitation probability despite the multi-CWE nature of the issue. SSVC Technical Impact of partial is consistent with the CVSS C:L/I:L/A:N profile. The combination of XSS, path traversal, and code injection in a single ticket is a meaningful escalation signal: a skilled attacker could use XSS as an entry point and chain path traversal or template injection for higher-impact post-authentication actions. However, no KEV listing and no confirmed POC mean this risk remains theoretical. Priority should be moderate - patch promptly in internet-exposed OFBiz instances, but this does not warrant emergency response over confirmed critical exploits.

An attacker crafts a malicious OFBiz URL embedding an XSS payload in a vulnerable parameter and delivers it via phishing email or message to an authenticated OFBiz user. When the victim clicks the link, the application reflects the unsanitized input into the response page, executing the attacker's script in the victim's browser under the OFBiz origin, enabling session token theft or unauthorized actions on the user's behalf. If path traversal or code injection vectors are also reachable through the same entry point, a more sophisticated attacker could leverage the XSS foothold to trigger server-side template injection for deeper compromise.