CVE-2026-81816

LowCVSS 3.5/10Last modified Nov 9, 2026

Description

XML External Entity (XXE) Injection in ContentWorker in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding content-author permission to read arbitrary server files and trigger server-side request forgery by storing a crafted text/xml DataResource containing an external entity declaration, causing ContentWorker's rendering of that content — via renderContentAsText and related CMS/help render paths — to parse the stored XML using FreeMarker's default NodeModel.parse DocumentBuilderFactory, which enables neither FEATURE_SECURE_PROCESSING nor external-entity/DTD restrictions, resolving the external entity and returning its content in the rendered response. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

Metrics

CVSS 3.1 3.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-611

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
Apache Software FoundationApache OFBiz< 24.09.08

References

Timeline

Published
Nov 5, 2026
Last modified
Nov 9, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-818177.2Affected versions of Flowintel contain an insecure direct object reference / broken object-level authorization issue across numerous task enCVE-2026-818188.6Affected versions of Flowintel contain an authorization flaw in the administrative user-edit API. The existing authorization check correctCVE-2026-818195.3Affected versions of Flowintel expose the /my_assignment/user API endpoint to any authenticated API user. The endpoint accepts a user_id parCVE-2026-81828.8IBM Langflow OSS 1.0.0 through 1.10.3 installations allow anyone on the internet to execute arbitrary code on the server without any credentCVE-2026-818205.1Affected versions of Flowintel construct timeline HTML using attacker-controllable MISP object fields such as: * object UUID; * CVE-2026-818218.4The vulnerability, if exploited, could allow a miscreant with read access to PIMBoards project files to decrypt and view sensitive informatiCVE-2026-818228.4The vulnerability, if exploited, could allow a miscreant with read access to PIMBoards project files to reverse engineer PIMBoards users’ apCVE-2026-818235.3The vulnerability, if exploited, could allow an unauthenticated miscreant to perform read operations intended only for PIMBoards users, resuCVE-2026-818244.7The vulnerability, if exploited, could allow a miscreant to run arbitrary JavaScript code in a browser session of a PIMBoards user who was sCVE-2026-818257.2The Simple Ajax Chat – Add a Fast, Secure Chat Box plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Chat Message in allCVE-2026-818269.1Affected versions of Flowintel do not revoke existing authenticated sessions when a user’s password is changed. This means that if an attaCVE-2026-818276.9Affected versions of Flowintel incorrectly attempted to validate login email addresses by calling Email(email). That does not perform WTForm
CVE-2026-81816: Low severity, CVSS 3.5 | Vulnix