{"id":"CVE-2026-82960","published":"2026-11-05T14:17:06.540","lastModified":"2026-11-06T05:18:34.743","description":"Improper Control of Generation of Code ('Code Injection') in ModelFormField in the Apache OFBiz cms plugin before 24.09.08 on all platforms allows a remote authenticated attacker holding only CMS content-editor access to execute arbitrary operating system commands as the OFBiz process user via a single HTTP POST request, by submitting a crafted caContentIdTo parameter to EditAddContent, because the CMS screen copies that parameter into a top-level context variable that is interpolated into a form field's use-when attribute and the resulting string is passed unvalidated to GroovyUtil.eval(), whose compile-time SecureASTCustomizer sandbox does not restrict runtime reflection, allowing a payload that closes the expanded string literal and invokes java.lang.Runtime via reflection. Users are recommended to upgrade to version 24.09.08, which fixes this issue.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-94"],"vendors":[],"products":[],"references":[{"url":"https://lists.apache.org/thread.html/7b2syzksp7klt9fvhdg0olldvs2g83lz","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A code injection flaw in Apache OFBiz's CMS plugin allows authenticated attackers with content-editor privileges to inject and execute arbitrary Groovy code via the caContentIdTo parameter, which is passed unsanitized to GroovyUtil.eval() and can bypass the compile-time sandbox using reflection to invoke java.lang.Runtime.","exploitability":"Exploitation requires valid credentials with CMS content-editor access; no privilege escalation or complex conditions are needed beyond that.","blast_radius":"Successful exploitation grants the attacker full control of the OFBiz process user, enabling full system compromise including data exfiltration, persistence, and lateral movement.","remediation":"Upgrade to Apache OFBiz version 24.09.08 or later, which contains the official fix for this vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["code-injection","rce","groovy","cms","reflection-bypass"],"model":"garnet-coder","analyzedAt":"2026-11-06T09:53:06.316Z"}}