CVE-2026-50223

Description

Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz allows a low-privileged authenticated user with Content/DataResource editing privileges to perform template injection attacks that could lead to Remote Code Execution. This issue affects Apache OFBiz: before 24.09.07. Users are recommended to upgrade to version 24.09.07, which fixes the issue.

PUBLISHED Reserved 2026-06-04 | Published 2026-06-10 | Updated 2026-06-10 | Assigner apache

Problem types

CWE-94 Improper Control of Generation of Code ('Code Injection')

Product status

Credits

yi reporter

Jongyeon Lee reporter

References

www.openwall.com/lists/oss-security/2026/06/10/13

lists.apache.org/thread/trr2p4zokg54glqlhjnglt4yr7n8t5xd vendor-advisory

cve.org (CVE-2026-50223)

nvd.nist.gov (CVE-2026-50223)

Download JSON