CVE-2026-82960 · Package
NO FIX YET · SEE WHAT TO DO
A user with CMS content-editor access can send one crafted HTTP POST to the EditAddContent screen and inject Groovy code that runs operating system commands. The commands run as the OFBiz process user, so the attacker gets code execution on the server.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Deployments of Apache OFBiz that run the cms plugin before 24.09.08 and let users hold CMS content-editor access are exposed. An attacker needs an authenticated account with that role, but a single request is enough to run commands as the OFBiz process user. Installations without the cms plugin or without untrusted content editors are lower risk.
Not affected if cms-plugin-absent, fixed-24.09.08-or-later, no-untrusted-content-editors
Who cares apache-ofbiz, cms-plugin, java, self-hosted
caContentIdTo parameter in web server access logs hitting EditAddContent24.09.08 or laterImproper Control of Generation of Code ('Code Injection') in ModelFormField in the Apache OFBiz cms plugin before 24.09.08 on all platforms allows a remote authenticated attacker holding only CMS content-editor access to execute arbitrary operating system commands as the OFBiz process user via a single HTTP POST request, by submitting a crafted caContentIdTo parameter to EditAddContent, because the CMS screen copies that parameter into a top-level context variable that is interpolated into a form field's use-when attribute and the resulting string is passed unvalidated to GroovyUtil.eval(), whose compile-time SecureASTCustomizer sandbox does not restrict runtime reflection, allowing a payload that closes the expanded string literal and invokes java.lang.Runtime via reflection. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.