Server-Side Request Forgery Vulnerability in Apache OFBiz

CVE-2026-81828

What is CVE-2026-81828?

The Server-Side Request Forgery vulnerability in Apache OFBiz allows authenticated back-office users with catalog permissions to exploit the system. By setting an arbitrary URL as the template location for product-store surveys, malicious users can cause the server to fetch and render content from attacker-controlled URLs, including internal network endpoints and local files. This vulnerability occurs because the affected system does not validate the scheme or host of the resolved URL when calling URL.openStream(). Consequently, the fetched content is rendered into the HTTP response for any shopper accessing the compromised survey, leading to potential data exposure. To mitigate this risk, users are advised to upgrade to version 24.09.08.

References