SB2026082590 - Multiple vulnerabilities in Apache OFBiz

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026082590

SB2026082590 - Multiple vulnerabilities in Apache OFBiz

Published: August 25, 2026

Security Bulletin ID SB2026082590
CSH Severity
High
Patch available
YES
Number of vulnerabilities 17
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 35% Medium 29% Low 35%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 17 vulnerabilities.


1) Code Injection (CVE-ID: CVE-2026-31379)

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to improper control of generation of code in Catalog Manager when handling crafted file upload input with path traversal. A remote attacker can upload a specially crafted file to execute arbitrary code.


2) Cross-site scripting (CVE-ID: CVE-2026-31906)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote attacker to execute arbitrary script code in a victim's browser.

The vulnerability exists due to cross-site scripting in layered-modal dialog parameters when generating web pages with unescaped HTML attribute values. A remote attacker can send a specially crafted request to execute arbitrary script code in a victim's browser.


3) Information disclosure (CVE-ID: CVE-2026-31909)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to exposure of sensitive information in shipment label image handling when accessing shipment label images without authorization. A remote attacker can access shipment label images to disclose sensitive information.


4) Input validation error (CVE-ID: CVE-2026-31910)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to perform server-side request forgery.

The vulnerability exists due to improper input validation in UI factory classes when processing user-supplied URLs or resource references. A remote attacker can send a specially crafted request to perform server-side request forgery.


5) Code Injection (CVE-ID: CVE-2026-35086)

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to improper control of generation of code in email services when processing template expansion. A remote user can send crafted input to execute arbitrary code.


6) Improper Authorization (CVE-ID: CVE-2026-45187)

CWE-ID: CWE-285 - Improper Authorization

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to submit system jobs.

The vulnerability exists due to improper authorization in Apache OFBiz Webtools when creating scheduled jobs. A remote user can create a scheduled job with insufficient authorization checks to submit system jobs.


7) Improper Authentication (CVE-ID: CVE-2026-45434)

CWE-ID: CWE-287 - Improper Authentication

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to improper authentication in password-change logic when handling password-change requests. A remote attacker can send a specially crafted request to execute arbitrary code.


8) Eval Injection (CVE-ID: CVE-2026-46586)

CWE-ID: CWE-95 - Eval Injection

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to eval injection in the traverseContent service when processing crafted input. A remote user can send crafted input to execute arbitrary code.


9) LDAP injection (CVE-ID: CVE-2026-41919)

CWE-ID: CWE-90 - Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass authentication.

The vulnerability exists due to improper neutralization of special elements used in an LDAP query in LDAP DN construction when processing user-supplied input for authentication. A remote attacker can supply specially crafted LDAP input to bypass authentication.


10) Improper Neutralization of Special Elements Used in a Template Engine (CVE-ID: CVE-2026-29207)

CWE-ID: CWE-1336 - Improper Neutralization of Special Elements Used in a Template Engine

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to improper neutralization of special elements used in a template engine in the Content component when processing FTL data resource templates. A remote user can create a specially crafted template to execute arbitrary code.


11) Path traversal (CVE-ID: CVE-2026-29220)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to read arbitrary files.

The vulnerability exists due to path traversal in the content component when handling crafted path input. A remote user can supply a crafted pathname to read arbitrary files.


12) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-29226)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to perform server-side request forgery.

The vulnerability exists due to server-side request forgery in Content component operations when handling content component operations. A remote user can invoke crafted content component operations to perform server-side request forgery.


13) Input validation error (CVE-ID: CVE-2026-31378)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to improper input validation in Apache OFBiz when processing crafted JSON input that can override attributes and bypass URL allowlist restrictions. A remote attacker can send specially crafted input to execute arbitrary code.


14) Improper Neutralization of Special Elements used in an Expression Language Statement (CVE-ID: CVE-2026-31380)

CWE-ID: CWE-917 - Improper Neutralization of Special Elements used in an Expression Language Statement

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to improper neutralization of special elements used in an expression language statement in the FreeMarker template processing functionality when handling duplicate parameters that bypass sanitization. A remote attacker can send a specially crafted request to execute arbitrary code.


15) Improper Authentication (CVE-ID: CVE-2026-31387)

CWE-ID: CWE-287 - Improper Authentication

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to impersonate other accounts.

The vulnerability exists due to improper authentication in cookie-based JWT handling when processing manipulated cookie values. A remote user can forge authentication tokens to impersonate other accounts.


16) Improper access control (CVE-ID: CVE-2026-31388)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper access control in program export feature when exporting program data in multi-tenant deployments. A remote user can access data belonging to another tenant to disclose sensitive information.

Only multi-tenant deployments are vulnerable.


17) Use of hard-coded credentials (CVE-ID: CVE-2026-31986)

CWE-ID: CWE-798 - Use of Hard-coded Credentials

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to use of a hard-coded cryptographic key in the JWT signing mechanism when processing forged authentication tokens. A remote attacker can send a specially crafted token to execute arbitrary code.


Remediation

Install update from vendor's website.

References