Cross-site Scripting Vulnerability in Apache OFBiz Catalog Image Viewer
CVE-2026-114229

Currently unrated

Key Information:

Vendor

Apache
Status
Apache Ofbiz
Vendor
CVE Published:
5 November 2026

What is CVE-2026-114229?

The Catalog image viewer in Apache OFBiz 24.09 and earlier versions is susceptible to Cross-site Scripting (XSS). This vulnerability enables unauthenticated attackers to inject and execute arbitrary JavaScript code in the browser sessions of logged-in back-office users by sending specially crafted viewImage URLs. To safeguard against such attacks, it is advised that users promptly upgrade to version 24.09.08, which addresses this issue effectively.

Affected Version(s)

Apache OFBiz 0 < 24.09.08

References

https://lists.apache.org/thread.html/7b2syzksp7klt9fvhdg0...
vendor-advisory

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

NGUYỄN DUY THẢO | https://github.com/duythao2004
.