CVE-2026-82960

Name of the Vulnerable Software and Affected Versions Apache OFBiz versions prior to 24.09.08

Description Code injection in the ModelFormField of the cms plugin allows a remote authenticated attacker with CMS content-editor access to execute arbitrary operating system commands as the OFBiz process user. This occurs via a single HTTP POST request to the 'EditAddContent' endpoint by submitting a crafted caContentIdTo parameter. The CMS screen copies this parameter into a top-level context variable that is interpolated into a form field's use-when attribute, and the resulting string is passed unvalidated to the GroovyUtil.eval() function. The compile-time SecureASTCustomizer sandbox does not restrict runtime reflection, enabling a payload to close the expanded string literal and invoke java.lang.Runtime via reflection.

Recommendations Upgrade to version 24.09.08.