CVE-2026-82960: Apache OFBiz: Widget use-when Expression Injection Bypasses Groovy Sandbox for authenticated RCE
Improper Control of Generation of Code ('Code Injection') in ModelFormField in the Apache OFBiz cms plugin before 24.09.08 on all platforms allows a remote authenticated attacker holding only CMS content-editor access to execute arbitrary operating system commands as the OFBiz process user via a single HTTP POST request, by submitting a crafted caContentIdTo parameter to EditAddContent, because the CMS screen copies that parameter into a top-level context variable that is interpolated into a form field's use-when attribute and the resulting string is passed unvalidated to GroovyUtil.eval(), whose compile-time SecureASTCustomizer sandbox does not restrict runtime reflection, allowing a payload that closes the expanded string literal and invokes java.lang.Runtime via reflection. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache OFBizto a version that resolves this vulnerability.Fixed in 24.09.08
Event History
Frequently Asked Questions
Which systems are exposed?
Apache OFBiz deployments using the CMS plugin before version 24.09.08 are affected on all platforms. Exposure requires that an attacker can authenticate with CMS content-editor access.
What level of access does an attacker need?
The attacker needs a valid authenticated account holding only CMS content-editor permissions. Anonymous access and higher administrative privileges are not required by the provided information.
How difficult is exploitation once access is obtained?
The issue can be exploited through a single HTTP POST request to EditAddContent with a crafted caContentIdTo parameter. The payload can execute operating-system commands as the OFBiz process user.
What is the recommended remediation?
Upgrade Apache OFBiz to version 24.09.08, which fixes the issue.