CVE-2026-82960

Summary

A code injection flaw in Apache OFBiz's CMS plugin allows authenticated attackers with content-editor privileges to inject and execute arbitrary Groovy code via the caContentIdTo parameter, which is passed unsanitized to GroovyUtil.eval() and can bypass the compile-time sandbox using reflection to invoke java.lang.Runtime.

Exploitability

Exploitation requires valid credentials with CMS content-editor access; no privilege escalation or complex conditions are needed beyond that.

Blast radius

Successful exploitation grants the attacker full control of the OFBiz process user, enabling full system compromise including data exfiltration, persistence, and lateral movement.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Apache OFBiz version 24.09.08 or later, which contains the official fix for this vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.