CVE-2026-81816
Received Received - Intake

XML External Entity Injection in Apache OFBiz ContentWorker

Publication date: 2026-11-05

Last updated on: 2026-11-05

Assigner: Apache Software Foundation

Description
XML External Entity (XXE) Injection in ContentWorker in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding content-author permission to read arbitrary server files and trigger server-side request forgery by storing a crafted text/xml DataResource containing an external entity declaration, causing ContentWorker's rendering of that content — via renderContentAsText and related CMS/help render paths — to parse the stored XML using FreeMarker's default NodeModel.parse DocumentBuilderFactory, which enables neither FEATURE_SECURE_PROCESSING nor external-entity/DTD restrictions, resolving the external entity and returning its content in the rendered response. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-05
Last Modified
2026-11-05
Generated
2026-11-05
AI Q&A
2026-11-05
EPSS Evaluated
N/A
NVD
CVE-2026-81816
EUVD
EUVD-2026-117482

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Apache Software Foundation Apache OFBiz 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-611 The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an XML External Entity (XXE) Injection vulnerability in Apache OFBiz 24.09 before 24.09.08. A remote authenticated attacker with content-author permission can exploit it by storing a crafted XML file that declares an external entity. When ContentWorker processes this file via renderContentAsText, it parses the XML using a vulnerable DocumentBuilderFactory that lacks secure processing and external entity restrictions. This allows the attacker to read arbitrary server files and perform server-side request forgery.

Impact Analysis

If you use Apache OFBiz 24.09 before 24.09.08, an attacker with content-author permissions could access sensitive files on your server, including configuration files, credentials, or other confidential data. They could also make unauthorized requests from your server to internal or external systems, potentially leading to further attacks or data exfiltration.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR's data protection principles or HIPAA's requirements for safeguarding protected health information. Organizations may face compliance violations, legal penalties, or reputational damage if exploited.

Mitigation Strategies

Upgrade Apache OFBiz to version 24.09.08 or later to fix the XXE vulnerability in ContentWorker.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-81816. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...