Apache OFBiz up to 24.09.07 EmailServices FlexibleStringExpander.expandString bodyText/subject code injection

Summaryinfo

A vulnerability has been found in Apache OFBiz up to 24.09.07 and classified as critical. This affects the function FlexibleStringExpander.expandString of the component EmailServices. This manipulation of the argument bodyText/subject causes code injection. This vulnerability is registered as CVE-2026-82912. Remote exploitation of the attack is possible. No exploit is available. The affected component should be upgraded.

Detailsinfo

A vulnerability has been found in Apache OFBiz up to 24.09.07 and classified as critical. Affected by this vulnerability is the function FlexibleStringExpander.expandString of the component EmailServices. The manipulation of the argument bodyText/subject with an unknown input leads to a code injection vulnerability. The CWE definition for the vulnerability is CWE-94. The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Improper Neutralization of Special Elements Used in an Expression Language Statement ('Expression Language Injection') in EmailServices in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only OFBTOOLS_VIEW and ACCOUNTING_VIEW, the two view-level permissions that open the Accounting application, to execute arbitrary operating system commands as the account running OFBiz, by submitting a ${groovy:...} expression as the bodyText or subject value to the shipped Send Per Email invoice form, because sendMailFromScreen passes those caller-supplied values through FlexibleStringExpander.expandString, which compiles and evaluates embedded Groovy on a class loader that carries none of the SecureASTCustomizer restrictions GroovyUtil.eval applies elsewhere, behind a service and request-map that declare no permission check beyond base authentication. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

It is possible to read the advisory at lists.apache.org. This vulnerability is known as CVE-2026-82912 since 08/31/2026. The exploitation appears to be easy. The attack can be launched remotely. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 11/05/2026). The attack technique deployed by this issue is T1059 according to MITRE ATT&CK.

Upgrading to version 24.09.08 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• Apache

Name

• OFBiz

Version

• 24.09.07

License

• open-source

Website

• Vendor: https://www.apache.org/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion