CVE-2026-81828

Server-Side Request Forgery in SurveyWrapper in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated back-office user holding catalog permission to cause the server to fetch and render attacker-controlled URLs — including internal network and cloud-metadata endpoints and...

CVE-2026-81828

Apache OFBiz versions 24.09 before 24.09.08 are vulnerable to a Server-Side Request Forgery (SSRF) in the SurveyWrapper component. An authenticated back-office user with catalog permission can trigger the server to fetch and render content from arbitrary URLs—including internal networks, cloud-me...

EUVD-2026-117481

Server-Side Request Forgery in SurveyWrapper in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated back-office user holding catalog permission to cause the server to fetch and render attacker-controlled URLs — including internal network and cloud-metadata endpoints and...