CVE-2026-82910

Name of the Vulnerable Software and Affected Versions Apache OFBiz versions 24.09 through 24.09.07

Description Server-Side Template Injection (SSTI) occurs in the MacroScreenRenderer. A remote authenticated attacker with specific view permissions can execute arbitrary operating system commands as the OFBiz service account via a single GET request. This is possible because the renderLink function concatenates link parameter values verbatim between apostrophes into an unquoted and unescaped template-source string. When this string is compiled and evaluated, the injected expression reaches the FlexibleStringExpander.expandString() function, leading to unsandboxed code execution through runtime-assembled Groovy interpolation.

Recommendations Upgrade to version 24.09.08.