Apache OFBiz <=24.09.05: EL Injection in Expression Language
CVE-2026-31380 Published on May 19, 2026
Apache OFBiz: FreeMarker SSTI via Duplicate Parameter Sanitization Bypass
Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in Apache OFBiz.
This issue affects Apache OFBiz: before 24.09.06.
Users are recommended to upgrade to version 24.09.06, which fixes the issue.
Vulnerability Analysis
CVE-2026-31380 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.
Weakness Type
What is an EL Injection Vulnerability?
The software constructs all or part of an expression language (EL) statement in a Java Server Page (JSP) using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended EL statement before it is executed.
CVE-2026-31380 has been classified to as an EL Injection vulnerability or weakness.
Products Associated with CVE-2026-31380
Want to know whenever a new CVE is published for Apache OFBiz? stack.watch will email you.
Affected Versions
Apache Software Foundation Apache OFBiz:- Before 24.09.06 is affected.