CVE-2025-26865 Apache OFBiz: Server-Side Template Injection affecting the ecommerce plugin leading to possible RCE

Low 3.5 Published 10 Mar 2025 Updated 11 Mar 2025

Attacker can achieve remote code execution via server-side template injection in the ecommerce plugin of Apache OFBiz.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-26865?

CVE-2025-26865 is a low-severity code injection vulnerability in Apache Ofbiz, published on 10 Mar 2025. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz.

This issue affects Apache OFBiz: from 18.12.17 before 18.12.18.

It's a regression between 18.12.17 and 18.12.18. In case you use something like that, which is not recommended! For security, only official releases should be used.

In other words, if you use 18.12.17 you are still safe. The version 18.12.17 is not a affected. But something between 18.12.17 and 18.12.18 is.

In that case, users are recommended to upgrade to version 18.12.18, which fixes the issue.

Weakness: CWE-1336

Which versions are affected by CVE-2025-26865?

It affects 1 product.

Products include Apache Ofbiz.

How do I fix CVE-2025-26865?

No fix has been published for CVE-2025-26865 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2025-26865 being exploited?

There is no known exploitation of CVE-2025-26865 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

All Apache Ofbiz vulnerabilities

Sources

Also known as GHSA-p9r8-xjx7-v86q.