PT-2026-41844 · Apache+1 · Apache Ofbiz+2

Sho Odagiri · CVE-2026-29207 · Published 2026-05-19 · Updated 2026-05-19

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Apache OFBiz versions prior to 24.09.06

Description Improper neutralization of special elements used in a template engine allows for potential exploitation. This occurs when the system fails to properly sanitize input used within the template engine, which can lead to Server-Side Template Injection (SSTI), a condition where an attacker can inject malicious code into a template that is then executed on the server.

Recommendations Upgrade to version 24.09.06. Remove content management grants from the Ecommerce Customer security group on production sites.

Exploit

Fix

Weakness Enumeration

CWE-1336

Related Identifiers

CVE-2026-29207

Affected Products

Apache Ofbiz

Ofbiz

Ofbiz-Framework

References · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29207.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-29207 · Security Note
• https://osv.dev/vulnerability/CVE-2026-29207 · Vendor Advisory
• https://lists.apache.org/thread/3rcrp8bh3x6ovrj5xnc0fm1f0nrn52r0 · Vendor Advisory
• http://openwall.com/lists/oss-security/2026/05/19/14 · Note