CVE-2026-29207

Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue. Please note that in the updated version, "Data Resource" records with dataTemplateTypeId = "FTL" are no longer supported. Additionally, in the updated version, the "Ecommerce Customer" security group no longer includes content management grants. Users are advised to remove these permissions from any production site as well.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://lists.apache.org/thread/3rcrp8bh3x6ovrj5xnc0fm1f0nrn52r0	Mailing List Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/05/19/14

Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:ofbiz:*:*:*:*:*:*:*:*

History

14 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Vulnerabilidad de Neutralización Incorrecta de Elementos Especiales Utilizados en un Motor de Plantillas en Apache OFBiz. Este problema afecta a Apache OFBiz: antes de 24.09.06. Se recomienda a los usuarios actualizar a la versión 24.09.06, que soluciona el problema. Tenga en cuenta que, en la versión actualizada, los registros de 'Recurso de Datos' con dataTemplateTypeId = 'FTL' ya no se admiten. Además, en la versión actualizada, el grupo de seguridad 'Cliente de Comercio Electrónico' ya no incluye permisos de gestión de contenido. Se aconseja a los usuarios eliminar estos permisos también de cualquier sitio de producción.

Information

Published : 2026-05-19 10:16

Updated : 2026-10-14 20:10

NVD link : CVE-2026-29207

Mitre link : CVE-2026-29207

CVE.ORG link : CVE-2026-29207

JSON object : View

Products Affected

apache

ofbiz

CWE

CWE-1336

Improper Neutralization of Special Elements Used in a Template Engine

{"id": "CVE-2026-29207", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-29207", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-19T13:35:39.540527Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache OFBiz", "versions": [{"status": "affected", "version": "0", "lessThan": "24.09.06", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-05-19T10:16:22.390", "references": [{"url": "https://lists.apache.org/thread/3rcrp8bh3x6ovrj5xnc0fm1f0nrn52r0", "tags": ["Mailing List", "Vendor Advisory"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/05/19/14", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-1336"}]}], "descriptions": [{"lang": "en", "value": "Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz.\n\nThis issue affects Apache OFBiz: before 24.09.06.\n\nUsers are recommended to upgrade to version 24.09.06, which fixes the issue.\n\nPlease note that in the updated version, \"Data Resource\" records with dataTemplateTypeId = \"FTL\" are no longer supported.\n\nAdditionally, in the updated version, the \"Ecommerce Customer\" security group no longer includes content management grants. Users are advised to remove these permissions from any production site as well."}, {"lang": "es", "value": "Vulnerabilidad de Neutralizaci\u00f3n Incorrecta de Elementos Especiales Utilizados en un Motor de Plantillas en Apache OFBiz.\n\nEste problema afecta a Apache OFBiz: antes de 24.09.06.\n\nSe recomienda a los usuarios actualizar a la versi\u00f3n 24.09.06, que soluciona el problema.\n\nTenga en cuenta que, en la versi\u00f3n actualizada, los registros de 'Recurso de Datos' con dataTemplateTypeId = 'FTL' ya no se admiten.\n\nAdem\u00e1s, en la versi\u00f3n actualizada, el grupo de seguridad 'Cliente de Comercio Electr\u00f3nico' ya no incluye permisos de gesti\u00f3n de contenido. Se aconseja a los usuarios eliminar estos permisos tambi\u00e9n de cualquier sitio de producci\u00f3n."}], "lastModified": "2026-10-14T20:10:00.190", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:ofbiz:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CEB63EC9-E307-4D7E-98E3-142E0225D178", "versionEndExcluding": "24.09.06"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}