CVE-2026-114229 · Package
NO FIX YET · SEE WHAT TO DO
The Catalog image viewer in Apache OFBiz 24.09 before 24.09.08 does not neutralize input in the viewImage URL, so a crafted link can inject JavaScript. An unauthenticated attacker can make a logged-in back-office user run that script in their browser session if the user opens the link from within the application.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams running Apache OFBiz 24.09 before 24.09.08 with the Catalog image viewer reachable from the back office. The exposure is through the browser of a logged-in back-office user who opens a crafted viewImage link, so teams on other OFBiz versions can skip it.
Not affected if version-24.09.08-or-later
Who cares apache-ofbiz, java, self-hosted
24.09.08.viewImage requests) in the application's web logs.24.09.08.Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in the Catalog image viewer in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an unauthenticated attacker to execute arbitrary JavaScript in the browser session of a logged-in back-office user via a crafted viewImage URL that the user opens from within the application. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.