CVE-2026-82910

Improper Neutralization of Special Elements Used in a Template Engine ('Server-Side Template Injection') in MacroScreenRenderer in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only the two view permissions of a control-servlet webapp (e.g. CATALOG_VIEW and OFBTOOLS_VIEW on /catalog, held by OFBiz's own shipped order-entry clerk role) to execute arbitrary operating system commands as the OFBiz service account with a single GET request, by placing an apostrophe followed by FreeMarker expression source in a screen link parameter value, because renderLink concatenates link parameter values verbatim between apostrophes into an unquoted, unescaped template-source string that is compiled and evaluated at render time, allowing the injected expression to reach the allow-listed FlexibleStringExpander.expandString call and, through a runtime-assembled Groovy interpolation, unsandboxed code execution. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

• CWE-1336

• https://lists.apache.org/thread.html/7b2syzksp7klt9fvhdg0olldvs2g83lz

Published

Nov 5, 2026

Last Modified

Nov 6, 2026

Status

Undergoing Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-82905A vulnerability was detected in sdcb chats up to 1.12.0. Thi…6.3
• CVE-2026-82906A flaw has been found in sdcb chats up to 1.12.0. This impac…3.7
• CVE-2026-82907Authentication Bypass by Capture-replay in ExternalLoginKeys…9.8
• CVE-2026-82908A vulnerability was found in MSI Dragon Center up to 2.0.155…8.8
• CVE-2026-82909A vulnerability was determined in QuantumNous new-api up to …4.3
• CVE-2026-8291A weakness has been identified in Open5GS up to 2.7.7. Impac…6.5
• CVE-2026-82911Cross-Site Request Forgery (CSRF) in the OrderConfirmControl…5.1
• CVE-2026-82912Improper Neutralization of Special Elements Used in an Expre…8.8
• CVE-2026-82914A security flaw has been discovered in kishan0725 Hospital-M…7.3
• CVE-2026-82915Improper Limitation of a Pathname to a Restricted Directory …6.5
• CVE-2026-82916Missing Authorization in XmlDsDump in Apache OFBiz 24.09 bef…7.1
• CVE-2026-82918XG VisionTerminal, XG-X VisionTerminal, LJ Series Terminal-S…5.5