Apache OFBiz up to 24.09.07 SurveyWrapper URL.openStream server-side request forgery

Summaryinfo

A vulnerability was found in Apache OFBiz. It has been declared as problematic. This affects the function URL.openStream of the component SurveyWrapper. The manipulation results in server-side request forgery. This vulnerability is reported as CVE-2026-81828. The attack can be launched remotely. No exploit exists. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Apache OFBiz. Affected is the function URL.openStream of the component SurveyWrapper. The manipulation with an unknown input leads to a server-side request forgery vulnerability. CWE is classifying the issue as CWE-918. The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. This is going to have an impact on confidentiality. CVE summarizes:

Server-Side Request Forgery in SurveyWrapper in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated back-office user holding catalog permission to cause the server to fetch and render attacker-controlled URLs — including internal network and cloud-metadata endpoints and local files via file:// — by setting an arbitrary URL as a product-store survey's template location, causing SurveyWrapper.getTemplate to call URL.openStream() on the resolved location and compile the fetched content as a FreeMarker template with no scheme or host validation, unlike the sibling widget location-loaders (ScreenFactory, FormFactory, GridFactory, MenuFactory, TreeFactory, ThemeFactory) which validate the resolved location before loading it. The fetched content is rendered into the HTTP response of any shopper who subsequently loads the affected product-store survey, making the disclosure non-blind. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

The advisory is shared for download at lists.apache.org. This vulnerability is traded as CVE-2026-81828 since 08/27/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 11/05/2026).

Upgrading to version 24.09.08 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• Apache

Name

• OFBiz

Version

• 10.04.02
• 11.04.01
• 11.04.02
• 11.04.03
• 11.04.04
• 12.04.01
• 12.04.02
• 12.04.03
• 12.04.06
• 13.07.02
• 13.07.03
• 16.11.01
• 16.11.02
• 16.11.03
• 16.11.04
• 16.11.05
• 16.11.06
• 16.11.07
• 17.12.01
• 17.12.03
• 17.12.04
• 17.12.06
• 17.12.07
• 17.12.08
• 18.12.06
• 18.12.09
• 18.12.10
• 18.12.11
• 18.12.12
• 18.12.13
• 18.12.14
• 18.12.15
• 18.12.16
• 18.12.17
• 18.12.18
• 18.12.19
• 24.09.02
• 24.09.03
• 24.09.06
• 24.09.07

License

• open-source

Website

• Vendor: https://www.apache.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion