CVE-2026-82910 · Package
NO FIX YET · SEE WHAT TO DO
Apache OFBiz 24.09 before 24.09.08 has a server-side template injection in MacroScreenRenderer's link rendering, reachable through a single GET request. A remote attacker with only the view permissions held by the shipped order-entry clerk role can execute arbitrary operating system commands as the OFBiz service account.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Deployments of Apache OFBiz 24.09 before 24.09.08 on any platform are affected, and the attacker only needs a low-privilege account with view permissions on a control-servlet webapp such as /catalog. Teams running OFBiz 24.09 should prioritize the upgrade, and teams on other release lines or that do not expose OFBiz to users with accounts can assess their exposure against the sources. The sources do not say whether other release lines are affected.
Not affected if no-user-accounts-exposed, version-not-24.09
Who cares apache-ofbiz, erp, java, self-hosted
version shown in the admin console.24.09.08.Improper Neutralization of Special Elements Used in a Template Engine ('Server-Side Template Injection') in MacroScreenRenderer in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only the two view permissions of a control-servlet webapp (e.g. CATALOG_VIEW and OFBTOOLS_VIEW on /catalog, held by OFBiz's own shipped order-entry clerk role) to execute arbitrary operating system commands as the OFBiz service account with a single GET request, by placing an apostrophe followed by FreeMarker expression source in a screen link parameter value, because renderLink concatenates link parameter values verbatim between apostrophes into an unquoted, unescaped template-source string that is compiled and evaluated at render time, allowing the injected expression to reach the allow-listed FlexibleStringExpander.expandString call and, through a runtime-assembled Groovy interpolation, unsandboxed code execution. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.