CVE-2026-82912 · Package
NO FIX YET · SEE WHAT TO DO
Apache OFBiz 24.09 before 24.09.08 lets a logged-in user with view-level accounting permissions inject a Groovy expression into the bodyText or subject field of the Send Per Email invoice form. The expression is evaluated outside the sandbox that normally restricts Groovy, so the attacker can execute operating system commands as the OFBiz account.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams running Apache OFBiz 24.09 before 24.09.08 with the Accounting application in use. The exposure requires a logged-in account holding OFBTOOLS_VIEW and ACCOUNTING_VIEW, and reaching the shipped Send Per Email invoice form. Deployments on other OFBiz versions, or where those permissions are not granted to anyone, are not covered by this description.
Not affected if managed-hosting, no-accounting-view-users, version-24.09.08-or-later
Who cares apache-ofbiz, erp, java, self-hosted
24.09. releases below 24.09.08 are affected.OFBTOOLS_VIEW and ACCOUNTING_VIEW can reach the Send Per Email invoice form.24.09.08.Improper Neutralization of Special Elements Used in an Expression Language Statement ('Expression Language Injection') in EmailServices in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only OFBTOOLS_VIEW and ACCOUNTING_VIEW, the two view-level permissions that open the Accounting application, to execute arbitrary operating system commands as the account running OFBiz, by submitting a ${groovy:...} expression as the bodyText or subject value to the shipped Send Per Email invoice form, because sendMailFromScreen passes those caller-supplied values through FlexibleStringExpander.expandString, which compiles and evaluates embedded Groovy on a class loader that carries none of the SecureASTCustomizer restrictions GroovyUtil.eval applies elsewhere, behind a service and request-map that declare no permission check beyond base authentication. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.