Server-Side Template Injection Vulnerability in Apache OFBiz
CVE-2026-85627

Currently unrated

Key Information:

Vendor

Apache
Status
Apache Ofbiz
Vendor
CVE Published:
5 November 2026

What is CVE-2026-85627?

A vulnerability exists in Apache OFBiz versions earlier than 24.09.08, which permits remote authenticated users with non-administrative accounts to execute arbitrary operating system commands. This occurs through improper neutralization of special elements used in the template engine, specifically via the updateLayoutImage event. The event allows for writing DataResource fields without adequate permission checks, enabling attackers to reclassify a maliciously crafted DataResource as an FTL template. The subsequent FreeMarker evaluation permits the execution of Groovy scripts unsandboxed, leading to potential unauthorized command execution under the OFBiz process user. Users are strongly advised to upgrade to the patched version 24.09.08 to mitigate this risk.

Affected Version(s)

Apache OFBiz 0 < 24.09.08

References

https://lists.apache.org/thread.html/7b2syzksp7klt9fvhdg0...
vendor-advisory

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Utku Sen
Krishna Uprit
.