CVE-2026-19929

Name of the Vulnerable Software and Affected Versions OpenBoxes versions prior to 0.9.8-hotfix1

Description An issue exists in the Template Processing component where the buildZebraTemplate() function in the grails-app/controllers/org/pih/warehouse/core/DocumentController.groovy file fails to properly neutralize special elements used in a template engine. This allows a remote attacker to manipulate the template processing.

Recommendations Upgrade to version 0.9.8-hotfix1 or 0.9.8. As a temporary mitigation, restrict access to the buildZebraTemplate() function.