CVE-2026-29207
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk49th percentile - higher than 49% of all known CVEs
Summary
Apache OFBiz before 24.09.06 contains a Template Engine Injection vulnerability due to improper neutralization of special elements. In version 24.09.06, "Data Resource" records with dataTemplateTypeId = "FTL" are no longer supported, and the "Ecommerce Customer" security group no longer includes content management grants.
Risk Assessment
An attacker may inject malicious templates, potentially leading to code execution or data disclosure. Additionally, there is a risk from excessive permissions of the "Ecommerce Customer" group.
Recommendation
Upgrade Apache OFBiz to version 24.09.06 and remove content management permissions from the "Ecommerce Customer" group in production.
Other vulnerabilities in Apache OFBiz
See all- CVE-2016-4462High
CVE-2016-4462 allows a malicious, logged-in user to manipulate the URL parameter externalLoginKey, potentially leading to remote code execution via a specially crafted Freemarker template.
- CVE-2026-45434Critical
CVE-2026-45434 in Apache OFBiz has a flaw in password-change logic that can lead to remote code execution. This issue affects versions before 24.09.06.
- CVE-2026-41919Critical
CVE-2026-41919 describes an improper neutralization of special elements used in LDAP queries, leading to LDAP Injection vulnerability in Apache OFBiz.
- CVE-2026-31986Critical
Use of hard-coded cryptographic key vulnerability in Apache OFBiz. This issue affects versions before 24.09.06.
- CVE-2024-45195HighActively exploited
Direct Request ('Forced Browsing') vulnerability in Apache OFBiz. This issue affects Apache OFBiz before 18.12.16.
- CVE-2024-38856CriticalActively exploited
Incorrect Authorization vulnerability in Apache OFBiz. This issue affects Apache OFBiz: through 18.12.14. Unauthenticated endpoints could allow execution of screen rendering code of screens if some preconditions are met (such as when the screen definitions don't explicitly check user's permissions because they rely on the configuration of their endpoints).
- CVE-2024-32113CriticalActively exploited
In Apache OFBiz before 18.12.13, a path traversal vulnerability exists due to improper limitation of a pathname to a restricted directory. Attackers can access files outside the intended directory.
- CVE-2012-1622Critical
Apache OFBiz 10.04.x before 10.04.02 allows remote attackers to execute arbitrary code via unspecified vectors.
- CVE-2016-2170Critical
Apache OFBiz versions 12.04.x before 12.04.06 and 13.07.x before 13.07.03 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library.
- CVE-2026-50223High
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz allows a low-privileged authenticated user with Content/DataResource editing privileges to perform template injection attacks that could lead to Remote Code Execution. This issue affects Apache OFBiz before 24.09.07.
Original NVD description (English source)
Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue. Please note that in the updated version, "Data Resource" records with dataTemplateTypeId = "FTL" are no longer supported. Additionally, in the updated version, the "Ecommerce Customer" security group no longer includes content management grants. Users are advised to remove these permissions from any production site as well.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS