Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.5

Apache OFBiz content component can execute code

CVE-2026-29207 · published 5 months ago
Summary

Apache OFBiz versions before 24.09.06 allow a low‑level user to trick the system into running their own commands through the content feature. Upgrade to version 24.09.06 to close the gap. After upgrading, remove any content‑management permissions from the Ecommerce Customer group and avoid using data templates marked as "FTL".

What to do
  • Update apache ofbiz to version 24.09.06 or later.
Affected software
VendorProductAffected versions
apache ofbiz < 24.09.06
cpe:2.3:a:apache:ofbiz:*:*:*:*:*:*:*:*
Original advisory text
Apache OFBiz: Low-Privilege SSTI Leading to RCE in the Content Component
Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz.

This issue affects Apache OFBiz: before 24.09.06.

Users are recommended to upgrade to version 24.09.06, which fixes the issue.

Please note that in the updated version, "Data Resource" records with dataTemplateTypeId = "FTL" are no longer supported.

Additionally, in the updated version, the "Ecommerce Customer" security group no longer includes content management grants. Users are advised to remove these permissions from any production site as well.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
6.5 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-1336Improper Neutralization of Special Elements Used in a Template Engine
Timeline
Published19 May 2026
Updated4 Nov 2026
First seen19 May 2026
Sources
CVE-2026-29207 · NVD
CVE-2026-29207 · OSV
Track software like this
Free during beta