CVE-2026-35086

Vulnerability

Apache OFBiz versions before 24.09.06 are affected by a code injection vulnerability in the email services component. The issue stems from improper control of code generation, specifically unsafe template expansion, which allows an attacker to inject arbitrary code [1].

Exploitation

An attacker must have authenticated access to the Apache OFBiz instance. The vulnerability is triggered by crafting a malicious email template that, when processed by the email services, executes injected code [1]. No additional user interaction is required beyond the attacker's authenticated session.

Impact

Successful exploitation results in remote code execution (RCE) in the context of the OFBiz application server. The attacker can execute arbitrary commands, potentially leading to full compromise of the application and underlying system [1].

Mitigation

The issue is fixed in Apache OFBiz version 24.09.06. Users are strongly recommended to upgrade to this version [1]. No workarounds are mentioned in the available references.