PT-2026-73075

CVE-2026-19929

Published

2026-08-16

Updated

2026-08-19

Description by

CVSS 2.0

6.5

Medium

MetricsAV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions OpenBoxes versions prior to 0.9.8-hotfix1

Description An issue exists in the Template Processing component where the buildZebraTemplate() function in the grails-app/controllers/org/pih/warehouse/core/DocumentController.groovy file fails to properly neutralize special elements used in a template engine. This allows a remote attacker to manipulate the template processing.

Recommendations Upgrade to version 0.9.8-hotfix1 or 0.9.8. As a temporary mitigation, restrict access to the buildZebraTemplate() function.

Exploitability

Exploit

Fix

Researchers

Vendors

Affected products

Weakness enumeration

CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine

CWE-791: Incomplete Filtering of Special Elements

Related identifiers

CVE-2026-19929