{"id":"CVE-2026-85627","kind":"vulnerability","aliases":["CVE-2026-85627"],"related":[],"title":"Apache OFBiz: any logged-in user can run operating system commands","description":"Improper Neutralization of Special Elements Used in a Template Engine ('Server-Side Template Injection') in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only a stock non-administrative account to execute arbitrary operating system commands as the OFBiz process user, by using the updateLayoutImage event, which writes DataResource fields with no permission check, to retype an attacker-created DataResource as an FTL template evaluating its own primary key, then using the resulting FreeMarker evaluation to plant an OFBiz Form Widget whose use-when attribute runs unsandboxed Groovy. Users are recommended to upgrade to version 24.09.08, which fixes this issue.","summary":"Apache OFBiz 24.09 before 24.09.08 lets a user with an ordinary non-admin account abuse the updateLayoutImage event to store a template that is evaluated and then runs unsandboxed Groovy. The result is arbitrary operating system commands as the OFBiz process user.","severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-ofbiz","java","runtime","self-hosted"],"not_affected_if":["auth-required","no-user-accounts"],"how_to_check":"- Check the installed OFBiz version and whether it is `24.09` earlier than `24.09.08`\n- Review which accounts can log in to the OFBiz instance, since any stock non-admin account is enough to exploit this","fix":"- Apache OFBiz: upgrade to `24.09.08`","status":"open","published_at":"2026-11-05T14:17:07+00:00","first_seen_at":"2026-11-05T14:39:19+00:00","triaged_at":"2026-11-05T14:40:34+00:00","updated_at":"2026-11-05T14:40:34+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-11-05T14:40:34Z","model":"claude-haiku-5-5","output":{"fix":"- Apache OFBiz: upgrade to `24.09.08`","reach":"internet","title":"Apache OFBiz: any logged-in user can run operating system commands","impact":"high","summary":"Apache OFBiz 24.09 before 24.09.08 lets a user with an ordinary non-admin account abuse the updateLayoutImage event to store a template that is evaluated and then runs unsandboxed Groovy. The result is arbitrary operating system commands as the OFBiz process user.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["apache-ofbiz","java","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Code runs as the OFBiz process user on the server","analyst_note":"Check the Apache OFBiz 24.09.08 release notes or advisory at the NVD link to confirm default configuration exposure and any workarounds.","how_to_check":"- Check the installed OFBiz version and whether it is `24.09` earlier than `24.09.08`\n- Review which accounts can log in to the OFBiz instance, since any stock non-admin account is enough to exploit this\n- unknown for further checks in the sources","plain_action":"","needs_analyst":true,"not_affected_if":["auth-required","no-user-accounts"],"who_is_affected":"Teams running Apache OFBiz 24.09 releases before 24.09.08 on any platform are exposed, as long as an attacker can log in with any ordinary account. The sources do not say whether default configurations are affected, so treat any OFBiz 24.09 instance with user logins as in scope. Instances running other OFBiz versions are not covered by this description.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000747,"input_tokens":4367,"output_tokens":620,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-85627':15A,18A '24.09':29B,88C '24.09.08':31B,90C,174C 'abus':42B 'account':41B,106C 'admin':40B 'administr':105C 'allow':94C 'apach':1A,20B,27B,86C 'apache-ofbiz':19B 'arbitrari':61B,109C 'attack':98C,135C 'attacker-cr':134C 'attribut':163C 'authent':97C 'check':130C 'command':12A,64B,112C 'creat':136C 'cve':13A,16A 'dataresourc':125C,137C 'element':74C 'engin':79C 'evalu':52B,142C,152C 'event':45B,122C 'execut':108C 'field':126C 'fix':176C 'form':157C 'freemark':151C 'ftl':140C 'groovi':57B,166C 'hold':99C 'host':26B 'improp':70C 'inject':84C 'issu':178C 'java':22B 'key':146C 'let':32B 'log':5A 'logged-in':4A 'neutral':71C 'non':39B,104C 'non-admin':38B 'non-administr':103C 'ofbiz':2A,21B,28B,67B,87C,115C,156C 'oper':10A,62B,110C 'ordinari':37B 'permiss':129C 'plant':154C 'platform':93C 'primari':145C 'process':68B,116C 'recommend':169C 'remot':96C 'result':59B,150C 'retyp':132C 'run':9A,55B,164C 'runtim':23B 'self':25B 'self-host':24B 'server':81C 'server-sid':80C 'side':82C 'special':73C 'stock':102C 'store':47B 'system':11A,63B,111C 'templat':49B,78C,83C,141C 'unsandbox':56B,165C 'updatelayoutimag':44B,121C 'upgrad':171C 'use':75C,119C,148C,161C 'use-when':160C 'user':7A,34B,69B,117C,167C 'version':173C 'whose':159C 'widget':158C 'write':124C","nicknames":[],"mitigations":[],"who_affected":"Teams running Apache OFBiz 24.09 releases before 24.09.08 on any platform are exposed, as long as an attacker can log in with any ordinary account. The sources do not say whether default configurations are affected, so treat any OFBiz 24.09 instance with user logins as in scope. Instances running other OFBiz versions are not covered by this description.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apacheofbiz","critical","java","runtime","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-05T14:17:07+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-85627","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85627","severity":null,"published_at":"2026-11-05T14:17:07+00:00","modified_at":"2026-11-05T14:17:07+00:00","first_seen_at":"2026-11-05T14:39:19+00:00","fetched_at":"2026-11-05T14:39:19+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}