CVE-2026-50223: Apache OFBiz: DataResource Low-Privileged Authenticated FreeMarker Template Injection Leads to Remote Code Execution

Synopsis

A server-side template injection vulnerability in Apache OFBiz allows a low-privileged authenticated user with Content/DataResource editing privileges to inject arbitrary FreeMarker template directives. The vulnerability is reachable over the network and requires no more than a standard low-privilege account, with no victim interaction needed. Successful exploitation gives the attacker full remote code execution on the host running OFBiz. A patched-image rebuild at version 24.09.07 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the OFBiz application over the network; the service must be exposed to the attacker's network path.

• AuthenticationRequired

  A low-privilege account with Content/DataResource editing privileges is sufficient; no administrative access is needed.

• Victim interactionNot required

  The attacker can complete the exploit entirely without involving or deceiving another user.

• Attack complexityDetail

  The exploit is reliable and condition-free, requiring no race conditions, memory layout knowledge, or special environmental setup.

Blast Radius

• The attacker executes arbitrary operating system commands on the OFBiz host, gaining a foothold on the underlying server.
• All data accessible to the OFBiz process is readable, including database credentials, session tokens, and business records.
• The attacker can write or overwrite files on the host filesystem, enabling persistence or further lateral movement.
• The OFBiz service can be crashed or rendered unavailable, disrupting business operations dependent on it.