CVE-2026-29207

Name of the Vulnerable Software and Affected Versions Apache OFBiz versions prior to 24.09.06

Description Improper neutralization of special elements used in a template engine allows for potential exploitation. This occurs when the system fails to properly sanitize input used within the template engine, which can lead to Server-Side Template Injection (SSTI), a condition where an attacker can inject malicious code into a template that is then executed on the server.

Recommendations Upgrade to version 24.09.06. Remove content management grants from the Ecommerce Customer security group on production sites.