PT-2026-41860 · Apache · Apache Ofbiz

Lwd3C · CVE-2026-46586 · Published 2026-05-19 · Updated 2026-05-21

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache OFBiz versions prior to 24.09.06

Description Improper Control of Generation of Code (Code Injection) and Improper Neutralization of Directives in Dynamically Evaluated Code (Eval Injection) in the 'traverseContent' service allow authenticated Groovy code execution.

Recommendations Upgrade to version 24.09.06.

Exploit

Fix

Code Injection

Eval Injection

Weakness Enumeration

CWE-94

CWE-95

Related Identifiers

CVE-2026-46586

Affected Products

Apache Ofbiz

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46586.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-46586 · Vendor Advisory
• https://lists.apache.org/thread/7mgjl81nrpxqtfcg6h5qtrx7wztbl4js · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-46586 · Security Note
• https://twitter.com/SelvaKtm2/status/2057469427860545626 · Twitter Post
• https://t.me/CVEtracker/54225 · Telegram Post
• http://openwall.com/lists/oss-security/2026/05/19/30 · Note