CVE-2026-82960
Improper Control of Generation of Code ('Code Injection') in ModelFormField in the Apache OFBiz cms…
- Risk score
- 53/100
- CVSS
- 8.8 v3.1
- Published
- 5 Nov 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Improper Control of Generation of Code ('Code Injection') in ModelFormField in the Apache OFBiz cms plugin before 24.09.08 on all platforms allows a remote authenticated attacker holding only CMS content-editor access to execute arbitrary operating system commands as the OFBiz process user via a single HTTP POST reque…
- Affected
- See advisory
- Fix
- Upgrade the product to 24.09.08 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 8.8 high
References
Original description
Improper Control of Generation of Code ('Code Injection') in ModelFormField in the Apache OFBiz cms plugin before 24.09.08 on all platforms allows a remote authenticated attacker holding only CMS content-editor access to execute arbitrary operating system commands as the OFBiz process user via a single HTTP POST request, by submitting a crafted caContentIdTo parameter to EditAddContent, because the CMS screen copies that parameter into a top-level context variable that is interpolated into a form field's use-when attribute and the resulting string is passed unvalidated to GroovyUtil.eval(), whose compile-time SecureASTCustomizer sandbox does not restrict runtime reflection, allowing a payload that closes the expanded string literal and invokes java.lang.Runtime via reflection. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
Last activity 5 Nov 2026. Patch Forecast updates every hour.