CVE-2026-19929: OpenBoxes Template Processing DocumentController.groovy buildZebraTemplate special elements in template engine
A vulnerability was identified in OpenBoxes up to 0.9.6. This impacts the function buildZebraTemplate of the file grails-app/controllers/org/pih/warehouse/core/DocumentController.groovy of the component Template Processing. The manipulation leads to improper neutralization of special elements used in a template engine. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. Upgrading to version 0.9.8-hotfix1 and 0.9.8 will fix this issue. The identifier of the patch is deeac6a4a7aba86ce99c4bda37142e41d209293e. It is recommended to upgrade the affected component.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenBoxesto a version that resolves this vulnerability.Fixed in 0.9.8-hotfix1Patch deeac6a4a7aba86ce99c4bda37142e41d209293e - Upgrade
Upgrade
OpenBoxesto a version that resolves this vulnerability.Fixed in 0.9.8Patch deeac6a4a7aba86ce99c4bda37142e41d209293e
Event History
Frequently Asked Questions
What is the severity of CVE-2026-19929?
The severity of CVE-2026-19929 is medium with a score of 6.3.
How do I fix CVE-2026-19929?
To fix CVE-2026-19929, upgrade OpenBoxes to version 0.9.7 or later, where the vulnerability is patched.
What impacts does CVE-2026-19929 have on OpenBoxes?
CVE-2026-19929 affects the buildZebraTemplate function, leading to improper neutralization of special elements in the template engine.
Is CVE-2026-19929 present in all versions of OpenBoxes?
CVE-2026-19929 is present in OpenBoxes versions up to and including 0.9.6.
What component is affected by CVE-2026-19929?
CVE-2026-19929 affects the Template Processing component within OpenBoxes.