XML External Entity Injection Vulnerability in Apache OFBiz

CVE-2026-81816

What is CVE-2026-81816?

A vulnerability exists in Apache OFBiz that allows an authenticated attacker with content-author permissions to exploit XML External Entity (XXE) injection. By crafting a specific text/xml DataResource containing an external entity declaration, the attacker can manipulate the ContentWorker's rendering process. This exploitation can lead to unauthorized access to arbitrary server files and potentially trigger server-side request forgery when the content is parsed. The default DocumentBuilderFactory settings used by FreeMarker do not enable secure processing, leaving systems exposed to this risk. Users are strongly recommended to upgrade to version 24.09.08 or newer to remediate this vulnerability.

References