CVE-2026-29207 Apache OFBiz: Low-Privilege SSTI Leading to RCE in the Content Component

Medium 6.5 Published 19 May 2026 Updated 19 May 2026

Low-privilege attackers can achieve remote code execution via Server-Side Template Injection in the Content Component of Apache OFBiz.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-29207?

CVE-2026-29207 is a medium-severity code injection vulnerability in Apache Ofbiz, published on 19 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz.

This issue affects Apache OFBiz: before 24.09.06.

Users are recommended to upgrade to version 24.09.06, which fixes the issue.

Please note that in the updated version, "Data Resource" records with dataTemplateTypeId = "FTL" are no longer supported.

Additionally, in the updated version, the "Ecommerce Customer" security group no longer includes content management grants. Users are advised to remove these permissions from any production site as well.

Weakness: CWE-1336

Which versions are affected by CVE-2026-29207?

It affects 1 product.

Products include Apache Ofbiz.

How do I fix CVE-2026-29207?

No fix has been published for CVE-2026-29207 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2026-29207 being exploited?

There is no known exploitation of CVE-2026-29207 in the wild and no public exploit code.

All Apache Ofbiz vulnerabilities

Sources

Also known as GHSA-jqmc-x3rh-92q5.