← Back to search

CVE-2026-82912

8.8 HIGH

Published 2026-11-05 · Updated 2026-11-06

AI risk analysis

Summary
Expression Language Injection in Apache OFBiz allows authenticated attackers with minimal permissions to execute arbitrary Groovy code via crafted email fields, leading to full system compromise.
Exploitability
Requires authentication with only OFBTOOLS_VIEW and ACCOUNTING_VIEW permissions; no special privileges or complex conditions needed.
Blast radius
Attackers can execute arbitrary OS commands as the OFBiz service account, risking full server compromise, data exfiltration, and lateral movement.
Detection
Monitor for requests to the Send Per Email invoice form with bodyText or subject parameters containing ${groovy:...} expressions in web server or application logs.
Prioritized remediation
Upgrade to Apache OFBiz version 24.09.08 immediately.
el-injectionrcegroovyofbizauth-bypass

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

Improper Neutralization of Special Elements Used in an Expression Language Statement ('Expression Language Injection') in EmailServices in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only OFBTOOLS_VIEW and ACCOUNTING_VIEW, the two view-level permissions that open the Accounting application, to execute arbitrary operating system commands as the account running OFBiz, by submitting a ${groovy:...} expression as the bodyText or subject value to the shipped Send Per Email invoice form, because sendMailFromScreen passes those caller-supplied values through FlexibleStringExpander.expandString, which compiles and evaluates embedded Groovy on a class loader that carries none of the SecureASTCustomizer restrictions GroovyUtil.eval applies elsewhere, behind a service and request-map that declare no permission check beyond base authentication. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-917

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.