CVE-2026-82912

Name of the Vulnerable Software and Affected Versions Apache OFBiz versions 24.09 through 24.09.07

Description An Expression Language Injection exists in EmailServices. A remote authenticated attacker with OFBTOOLS VIEW and ACCOUNTING VIEW permissions can execute arbitrary operating system commands as the account running the software. This occurs when a ${groovy:...} expression is submitted as the bodyText or subject value to the Send Per Email invoice form. The sendMailFromScreen function passes these values through FlexibleStringExpander.expandString, which evaluates embedded Groovy without the SecureASTCustomizer restrictions typically applied by GroovyUtil.eval.

Recommendations Upgrade to version 24.09.08.