← CVE Intelligence

CVE-2026-31380

Apache OFBiz: FreeMarker SSTI via Duplicate Parameter Sanitization Bypass PUBLISHED

Description (CNA)

Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.

Affected (CNA)

Vendor / productVersions
Apache Software Foundation / Apache OFBizaffected 0 before 24.09.06

CWE

CWE-917

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.