{"id":"CVE-2026-82910","kind":"vulnerability","aliases":["CVE-2026-82910"],"related":[],"title":"Apache OFBiz: template injection lets an authenticated user run OS commands","description":"Improper Neutralization of Special Elements Used in a Template Engine ('Server-Side Template Injection') in MacroScreenRenderer in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only the two view permissions of a control-servlet webapp (e.g. CATALOG_VIEW and OFBTOOLS_VIEW on /catalog, held by OFBiz's own shipped order-entry clerk role) to execute arbitrary operating system commands as the OFBiz service account with a single GET request, by placing an apostrophe followed by FreeMarker expression source in a screen link parameter value, because renderLink concatenates link parameter values verbatim between apostrophes into an unquoted, unescaped template-source string that is compiled and evaluated at render time, allowing the injected expression to reach the allow-listed FlexibleStringExpander.expandString call and, through a runtime-assembled Groovy interpolation, unsandboxed code execution. Users are recommended to upgrade to version 24.09.08, which fixes this issue.","summary":"Apache OFBiz 24.09 before 24.09.08 has a server-side template injection in MacroScreenRenderer's link rendering, reachable through a single GET request. A remote attacker with only the view permissions held by the shipped order-entry clerk role can execute arbitrary operating system commands as the OFBiz service account.","severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-ofbiz","erp","java","package","self-hosted"],"not_affected_if":["no-user-accounts-exposed","version-not-24.09"],"how_to_check":"- Confirm the installed OFBiz version is in the 24.09 line, for example by checking the release files or the `version` shown in the admin console.\n- Identify which accounts hold CATALOG_VIEW or OFBTOOLS_VIEW permissions, including the order-entry clerk role.","fix":"- Apache OFBiz 24.09 users: upgrade to `24.09.08`.","status":"open","published_at":"2026-11-05T14:17:05+00:00","first_seen_at":"2026-11-05T14:39:18+00:00","triaged_at":"2026-11-05T14:40:43+00:00","updated_at":"2026-11-05T14:40:43+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-05T14:40:43Z","model":"claude-haiku-5-5","output":{"fix":"- Apache OFBiz 24.09 users: upgrade to `24.09.08`.","reach":"internet","title":"Apache OFBiz: template injection lets an authenticated user run OS commands","impact":"high","summary":"Apache OFBiz 24.09 before 24.09.08 has a server-side template injection in MacroScreenRenderer's link rendering, reachable through a single GET request. A remote attacker with only the view permissions held by the shipped order-entry clerk role can execute arbitrary operating system commands as the OFBiz service account.","audience":"businesses","category":"package","nicknames":[],"who_cares":["apache-ofbiz","java","self-hosted","erp"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Code runs on the server as the OFBiz service account.","analyst_note":"Check the NVD entry and Apache OFBiz security advisory to confirm affected release lines and whether any setting changes exposure.","how_to_check":"- Confirm the installed OFBiz version is in the 24.09 line, for example by checking the release files or the `version` shown in the admin console.\n- Identify which accounts hold CATALOG_VIEW or OFBTOOLS_VIEW permissions, including the order-entry clerk role.","plain_action":"","needs_analyst":true,"not_affected_if":["version-not-24.09","no-user-accounts-exposed"],"who_is_affected":"Deployments of Apache OFBiz 24.09 before 24.09.08 on any platform are affected, and the attacker only needs a low-privilege account with view permissions on a control-servlet webapp such as /catalog. Teams running OFBiz 24.09 should prioritize the upgrade, and teams on other release lines or that do not expose OFBiz to users with accounts can assess their exposure against the sources. The sources do not say whether other release lines are affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000791,"input_tokens":4482,"output_tokens":685,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-82910':14A,17A '/catalog':128C '24.09':29B,98C '24.09.08':31B,100C,226C 'account':77B,150C 'allow':104C,196C,204C 'allow-list':203C 'apach':1A,19B,27B,96C 'apache-ofbiz':18B 'apostroph':159C,179C 'arbitrari':69B,142C 'assembl':213C 'attack':52B,108C 'authent':7A,107C 'call':207C 'catalog':122C 'clerk':65B,138C 'code':217C 'command':11A,72B,145C 'compil':190C 'concaten':173C 'control':118C 'control-servlet':117C 'cve':12A,15A 'e.g':121C 'element':82C 'engin':87C 'entri':64B,137C 'erp':21B 'evalu':192C 'execut':68B,141C,218C 'express':163C,199C 'fix':228C 'flexiblestringexpander.expandstring':206C 'follow':160C 'freemark':162C 'get':48B,154C 'groovi':214C 'held':58B,129C 'hold':109C 'host':26B 'improp':78C 'inject':4A,38B,92C,198C 'interpol':215C 'issu':230C 'java':22B 'let':5A 'link':42B,168C,174C 'list':205C 'macroscreenrender':40B,94C 'neutral':79C 'ofbiz':2A,20B,28B,75B,97C,131C,148C 'ofbtool':125C 'oper':70B,143C 'order':63B,136C 'order-entri':62B,135C 'os':10A 'packag':23B 'paramet':169C,175C 'permiss':57B,114C 'place':157C 'platform':103C 'reach':201C 'reachabl':44B 'recommend':221C 'remot':51B,106C 'render':43B,194C 'renderlink':172C 'request':49B,155C 'role':66B,139C 'run':9A 'runtim':212C 'runtime-assembl':211C 'screen':167C 'self':25B 'self-host':24B 'server':35B,89C 'server-sid':34B,88C 'servic':76B,149C 'servlet':119C 'ship':61B,134C 'side':36B,90C 'singl':47B,153C 'sourc':164C,186C 'special':81C 'string':187C 'system':71B,144C 'templat':3A,37B,86C,91C,185C 'template-sourc':184C 'time':195C 'two':112C 'unescap':183C 'unquot':182C 'unsandbox':216C 'upgrad':223C 'use':83C 'user':8A,219C 'valu':170C,176C 'verbatim':177C 'version':225C 'view':56B,113C,123C,126C 'webapp':120C","nicknames":[],"mitigations":[],"who_affected":"Deployments of Apache OFBiz 24.09 before 24.09.08 on any platform are affected, and the attacker only needs a low-privilege account with view permissions on a control-servlet webapp such as /catalog. Teams running OFBiz 24.09 should prioritize the upgrade, and teams on other release lines or that do not expose OFBiz to users with accounts can assess their exposure against the sources. The sources do not say whether other release lines are affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apacheofbiz","critical","erp","java","package","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-05T14:17:05+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-82910","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82910","severity":null,"published_at":"2026-11-05T14:17:05+00:00","modified_at":"2026-11-05T14:17:05+00:00","first_seen_at":"2026-11-05T14:39:18+00:00","fetched_at":"2026-11-05T14:39:18+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}