← Back to search

CVE-2026-82910

8.8 HIGH

Published 2026-11-05 · Updated 2026-11-06

AI risk analysis

Summary
Server-Side Template Injection (CWE-1336) in Apache OFBiz's MacroScreenRenderer allows authenticated attackers with minimal permissions to inject FreeMarker expressions via link parameters, leading to unsandboxed Groovy code execution and full system compromise.
Exploitability
Exploitation requires only low-privilege authentication (e.g., the shipped order-entry clerk role) and a single GET request; no additional privileges or user interaction are needed.
Blast radius
Successful exploitation grants the attacker the same OS-level privileges as the OFBiz service account, enabling full system compromise including data exfiltration, lateral movement, and persistence.
Detection
No reliable host or network indicator is derivable from the published description.
Prioritized remediation
Upgrade to Apache OFBiz version 24.09.08 or later, which contains the official fix for this issue.
sstircetemplate-injectionwebappofbiz

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

Improper Neutralization of Special Elements Used in a Template Engine ('Server-Side Template Injection') in MacroScreenRenderer in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only the two view permissions of a control-servlet webapp (e.g. CATALOG_VIEW and OFBTOOLS_VIEW on /catalog, held by OFBiz's own shipped order-entry clerk role) to execute arbitrary operating system commands as the OFBiz service account with a single GET request, by placing an apostrophe followed by FreeMarker expression source in a screen link parameter value, because renderLink concatenates link parameter values verbatim between apostrophes into an unquoted, unescaped template-source string that is compiled and evaluated at render time, allowing the injected expression to reach the allow-listed FlexibleStringExpander.expandString call and, through a runtime-assembled Groovy interpolation, unsandboxed code execution. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-1336

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.