CVE-2026-85627

Name of the Vulnerable Software and Affected Versions Apache OFBiz versions 24.09 through 24.09.07

Description An issue exists where improper neutralization of special elements in a template engine leads to Server-Side Template Injection (SSTI). A remote authenticated attacker with a non-administrative account can execute arbitrary operating system commands as the OFBiz process user. This is achieved by using the updateLayoutImage event to write DataResource fields without permission checks, retyping a DataResource as a FreeMarker Template Language (FTL) template that evaluates its own primary key. This process allows the attacker to plant an OFBiz Form Widget where the use-when attribute executes unsandboxed Groovy code.

Recommendations Upgrade to version 24.09.08.