Vulnerabilities

Improper Neutralization of Special Elements Used in a Template Engine ('Server-Side Template Injection') in MacroScreenRenderer in Apache OFBiz 24.09…

Improper Neutralization of Special Elements Used in a Template Engine ('Server-Side Template Injection') in MacroScreenRenderer in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only the two view permissions of a control-servlet webapp (e.g. CATALOG_VIEW and OFBTOOLS_VIEW on /catalog, held by OFBiz's own shipped order-entry clerk role) to execute arbitrary operating system commands as the OFBiz service account with a single GET request, by placing an apostrophe followed by FreeMarker expression source in a screen link parameter value, because renderLink concatenates link parameter values verbatim between apostrophes into an unquoted, unesca

Read at NIST National Vulnerability Database (CVE API 2.0)

Vendor

Apache Software Foundation

Product

Apache OFBiz

Fix

available

Weakness

CWE-1336

Exposure class

Web platform

NVD status

Awaiting Analysis

• NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
• CVE-2026-82910 on this site · NVD · CVE.org · Vulnpedia

Other items that share a CVE or were clustered with this one.

1. 25
   CVE NVD 1h ago

   Improper Neutralization of Special Elements Used in a Template Engine ('Server-Side Template Injection') in Apache OFBiz 24.09 before 24.09.08 on all…

   Fix available CVE-2026-85627 Apache Software Foundation