CVE-2026-85627 · Runtime
NO FIX YET · SEE WHAT TO DO
Apache OFBiz 24.09 before 24.09.08 lets a user with an ordinary non-admin account abuse the updateLayoutImage event to store a template that is evaluated and then runs unsandboxed Groovy. The result is arbitrary operating system commands as the OFBiz process user.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams running Apache OFBiz 24.09 releases before 24.09.08 on any platform are exposed, as long as an attacker can log in with any ordinary account. The sources do not say whether default configurations are affected, so treat any OFBiz 24.09 instance with user logins as in scope. Instances running other OFBiz versions are not covered by this description.
Not affected if auth-required, no-user-accounts
Who cares apache-ofbiz, java, self-hosted
24.09 earlier than 24.09.0824.09.08Improper Neutralization of Special Elements Used in a Template Engine ('Server-Side Template Injection') in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only a stock non-administrative account to execute arbitrary operating system commands as the OFBiz process user, by using the updateLayoutImage event, which writes DataResource fields with no permission check, to retype an attacker-created DataResource as an FTL template evaluating its own primary key, then using the resulting FreeMarker evaluation to plant an OFBiz Form Widget whose use-when attribute runs unsandboxed Groovy. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.