CVE-2026-81816 · Runtime
NO FIX YET · SEE WHAT TO DO
Apache OFBiz 24.09 before 24.09.08 parses stored text/xml content with an XML parser that resolves external entities. A logged-in user with content-author permission can read arbitrary files on the server and trigger server-side requests.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Deployments of Apache OFBiz 24.09 before 24.09.08 where users hold content-author permission and content is rendered through ContentWorker, including CMS and help render paths. An attacker needs an authenticated account with that permission; installations on 24.09.08 or later, or without untrusted content authors, are not affected by the sources' description.
Not affected if no-content-author-users, version-24.09.08-or-later
Who cares apache-ofbiz, java, self-hosted
framework/common/ofbiz-container or release files, and look for a version below 24.09.0824.09.08XML External Entity (XXE) Injection in ContentWorker in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding content-author permission to read arbitrary server files and trigger server-side request forgery by storing a crafted text/xml DataResource containing an external entity declaration, causing ContentWorker's rendering of that content — via renderContentAsText and related CMS/help render paths — to parse the stored XML using FreeMarker's default NodeModel.parse DocumentBuilderFactory, which enables neither FEATURE_SECURE_PROCESSING nor external-entity/DTD restrictions, resolving the external entity and returning its content in the rendered response. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.