CVE-2026-82910

Improper Neutralization of Special Elements Used in a Template Engine 'Server-Side Template Injection' in MacroScreenRenderer in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only the two view permissions of a control-servlet webapp e.g...

CVE-2026-82910 Apache OFBiz: renderLink compiles link parameters as FreeMarker source

Improper Neutralization of Special Elements Used in a Template Engine 'Server-Side Template Injection' in MacroScreenRenderer in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only the two view permissions of a control-servlet webapp e.g...

CVE-2026-82910

Apache OFBiz versions 24.09 before 24.09.08 are vulnerable to Server-Side Template Injection (SSTI) within the MacroScreenRenderer component. The root cause is that the renderLink function concatenates link parameter values verbatim into an unquoted, unescaped template-source string. A remote aut...