EUVD-2026-117482

XML External Entity XXE Injection in ContentWorker in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding content-author permission to read arbitrary server files and trigger server-side request forgery by storing a crafted text/xml DataResource...

CVE-2026-81816

Apache OFBiz versions 24.09 before 24.09.08 are vulnerable to an XML External Entity (XXE) Injection in the ContentWorker component. A remote authenticated attacker with content-author permissions can store a crafted text/xml DataResource containing an external entity declaration. Because the ren...

CVE-2026-81816 Apache OFBiz: XML external entity injection (XXE)

XML External Entity XXE Injection in ContentWorker in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding content-author permission to read arbitrary server files and trigger server-side request forgery by storing a crafted text/xml DataResource...