Loading vulnerability…
Authenticated RCE via widget expression injection in Apache OFBiz CMS
CVE-2026-82960 is a code injection vulnerability in ModelFormField in the Apache OFBiz CMS plugin before version 24.09.08, affecting all platforms. The CMS EditAddContent screen copies the attacker-controlled caContentIdTo parameter into a top-level context variable, which is interpolated into a form field's use-when attribute. The resulting expression is passed without validation to GroovyUtil.eval(). A crafted value can terminate the expanded string literal and invoke java.lang.Runtime through reflection, bypassing the compile-time SecureASTCustomizer sandbox because it does not restrict runtime reflection. An authenticated attacker with only CMS content-editor access can execute arbitrary operating system commands through a single HTTP POST request.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows a CMS content editor to execute arbitrary operating system commands with the privileges of the OFBiz process user, crossing the boundary between application-level content editing and server-side execution. This can compromise the confidentiality, integrity, and availability of application data and other resources accessible to that process. Operating-system administrative privileges are not inherently granted.
If you can’t patch tonight, do this now.
No interim workaround is specified. Pending upgrade, restrict CMS content-editor access to trusted users and limit access to the affected EditAddContent endpoint. These measures reduce exposure but do not correct the code injection flaw.
Patch, then assume compromise.
Upgrade Apache OFBiz to version 24.09.08, which fixes this vulnerability.
No public exploits tracked yet. Mallory keeps watching.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.