CVE-2026-82912: Apache OFBiz: Unsandboxed Groovy compiled from a service parameter
Improper Neutralization of Special Elements Used in an Expression Language Statement ('Expression Language Injection') in EmailServices in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only OFBTOOLSVIEW and ACCOUNTINGVIEW, the two view-level permissions that open the Accounting application, to execute arbitrary operating system commands as the account running OFBiz, by submitting a ${groovy:...} expression as the bodyText or subject value to the shipped Send Per Email invoice form, because sendMailFromScreen passes those caller-supplied values through FlexibleStringExpander.expandString, which compiles and evaluates embedded Groovy on a class loader that carries none of the SecureASTCustomizer restrictions GroovyUtil.eval applies elsewhere, behind a service and request-map that declare no permission check beyond base authentication. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache OFBizto a version that resolves this vulnerability.Fixed in 24.09.08
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated remote user with the OFBTOOLS_VIEW and ACCOUNTING_VIEW permissions can exploit it. These are view-level permissions that provide access to the Accounting application.
What does an attacker need to submit?
The attacker must submit a ${groovy:...} expression in the bodyText or subject field of the shipped Send Per Email invoice form. The expression is compiled and evaluated as Groovy.
What is the impact of successful exploitation?
An attacker can execute arbitrary operating system commands as the account running OFBiz. This can affect confidentiality, integrity, and availability of the OFBiz host.
Which deployments are affected and what is the remediation?
Apache OFBiz 24.09 versions before 24.09.08 are affected on all platforms. Upgrade to version 24.09.08.