CVE-2026-31380

Apache OFBiz versions prior to 24.09.06 are vulnerable to an Expression Language Injection flaw caused by the improper neutralization of special elements within expression language statements. Specifically, a FreeMarker SSTI (Server-Side Template Injection) can occur via a duplicate parameter san...

CVE-2026-31380 Apache OFBiz: FreeMarker SSTI via Duplicate Parameter Sanitization Bypass

Improper Neutralization of Special Elements used in an Expression Language Statement 'Expression Language Injection' vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue...