Apache OFBiz vulnerabilities

Missing Authorization in XmlDsDump in Apache OFBiz 24.09 before 24.09.08 allows a remote authenticated attacker with only webtools base permissions (OFBTOOLS_VIEW, WEBTOOLS_VIEW) to export any database entity, including UserLogin with password hashes, to any writable filesystem path, and to create directories or truncate files, because the screen action writes data before the ENTITY_MAINT permission check.

Expression Language Injection in EmailServices in Apache OFBiz 24.09 before 24.09.08 allows a remote authenticated attacker with OFBTOOLS_VIEW and ACCOUNTING_VIEW permissions to execute arbitrary OS commands as the OFBiz process user by submitting a ${groovy:...} expression in the bodyText or subject of the Send Per Email form, because values are passed through FlexibleStringExpander.expandString without sandbox restrictions.

Server-Side Template Injection in MacroScreenRenderer in Apache OFBiz 24.09 before 24.09.08 allows a remote authenticated attacker with view permissions (e.g., CATALOG_VIEW and OFBTOOLS_VIEW) to execute arbitrary OS commands as the OFBiz service account by placing an apostrophe and FreeMarker expression in a screen link parameter value, because renderLink concatenates values without quoting or escaping.

Uncontrolled Resource Consumption in ServiceMultiEventHandler in Apache OFBiz 24.09 before 24.09.08 allows a remote unauthenticated attacker to pin a server request thread for an attacker-chosen number of synchronous service dispatches (up to integer maximum) via a single small HTTP request, because the row count is derived from the 'o' suffix with no upper bound and the handler loops dispatcher.runSync.

Server-Side Request Forgery in ViewDataFile in Apache OFBiz 24.09 before 24.09.08 allows a remote authenticated attacker with base webtools permissions (OFBTOOLS_VIEW, WEBTOOLS_VIEW) to cause the server to issue arbitrary outbound HTTP requests, and an attacker with ENTITY_MAINT and DATAFILE_MAINT to read arbitrary local files via file: URL, by supplying DEFINITION_LOCATION or DATAFILE_LOCATION parameters, because ViewDataFile.groovy dereferences them as java.net.URL without scheme allow-list, host filter, or egress control.

Missing check for ACCOUNTING_UPDATE / ACCOUNTING_CREATE in accounting allows a user with only ACCOUNTING_VIEW permission to update/create PaymentApplication. Affected versions before 24.09.08.

Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz allows a low-privileged authenticated user with Content/DataResource editing privileges to perform template injection attacks that could lead to Remote Code Execution. This issue affects Apache OFBiz before 24.09.07.

Apache OFBiz before version 24.09.07 contains a privilege escalation vulnerability that allows a low-privileged authenticated user to obtain higher privileges.

Apache OFBiz has a vulnerability related to improper control of code generation and improper neutralization of directives in dynamically evaluated code. This issue affects versions before 24.09.06.

Apache OFBiz Webtools before 24.09.06 contains an Improper Authorization vulnerability.

Apache OFBiz before 24.09.06 contains a Code Injection vulnerability in email services.

The Server-Side Request Forgery (SSRF) vulnerability in Apache OFBiz before version 24.09.06 allows an attacker to use the server to send requests to internal or external resources.

The CVE-2026-31909 vulnerability in Apache OFBiz involves exposure of sensitive information to unauthorized actors. This issue affects versions before 24.09.06.

A Cross-site Scripting (XSS) vulnerability in Apache OFBiz results from improper neutralization of input during web page generation. The issue affects versions before 24.09.06.

Improper Access Control vulnerability in Apache OFBiz in multi-tenant deployments. This issue affects Apache OFBiz: before 24.09.06.

An improper authentication vulnerability in Apache OFBiz allows bypassing authorization mechanisms. The issue affects versions before 24.09.06.

Apache OFBiz before 24.09.06 contains an Expression Language Injection vulnerability due to improper neutralization of special elements.

Apache OFBiz before 24.09.06 contains Cross-site Scripting (XSS), Path Traversal, and Code Injection vulnerabilities due to improper input neutralization and pathname restrictions.

Apache OFBiz before 24.09.06 contains an Improper Input Validation vulnerability.

The SSRF vulnerability in Apache OFBiz, occurring in Content component operations, allows an attacker to send malicious requests to the server. This issue affects versions of Apache OFBiz before 24.09.06.

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz. This issue affects Apache OFBiz before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.

Apache OFBiz before 24.09.06 contains a Template Engine Injection vulnerability due to improper neutralization of special elements. In version 24.09.06, "Data Resource" records with dataTemplateTypeId = "FTL" are no longer supported, and the "Ecommerce Customer" security group no longer includes content management grants.

A reflected cross-site scripting vulnerability exists in Apache OFBiz. This issue affects versions before 24.09.03.

An unrestricted upload of a file with a dangerous type vulnerability exists in Apache OFBiz. The issue affects versions before 24.09.03 and may allow uploading a malicious file.