CVE-2026-81828
Received Received - Intake

Server-Side Request Forgery in Apache OFBiz SurveyWrapper

Publication date: 2026-11-05

Last updated on: 2026-11-05

Assigner: Apache Software Foundation

Description
Server-Side Request Forgery in SurveyWrapper in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated back-office user holding catalog permission to cause the server to fetch and render attacker-controlled URLs — including internal network and cloud-metadata endpoints and local files via file:// — by setting an arbitrary URL as a product-store survey's template location, causing SurveyWrapper.getTemplate to call URL.openStream() on the resolved location and compile the fetched content as a FreeMarker template with no scheme or host validation, unlike the sibling widget location-loaders (ScreenFactory, FormFactory, GridFactory, MenuFactory, TreeFactory, ThemeFactory) which validate the resolved location before loading it. The fetched content is rendered into the HTTP response of any shopper who subsequently loads the affected product-store survey, making the disclosure non-blind. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-05
Last Modified
2026-11-05
Generated
2026-11-05
AI Q&A
2026-11-05
EPSS Evaluated
N/A
NVD
CVE-2026-81828
EUVD
EUVD-2026-117481

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Apache Software Foundation Apache OFBiz 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Server-Side Request Forgery (SSRF) vulnerability in Apache OFBiz 24.09 before 24.09.08. An authenticated back-office user with catalog permissions can manipulate a product-store survey's template location to set an arbitrary URL. When the survey is accessed, the server fetches and renders the content from the attacker-controlled URL without proper validation, potentially exposing internal network resources, cloud metadata, or local files.

Detection Guidance

Check Apache OFBiz versions before 24.09.08. Inspect product-store survey template locations for arbitrary URLs. Monitor network traffic for unexpected outbound requests to internal or cloud-metadata endpoints.

Impact Analysis

This vulnerability allows an attacker to access internal systems, read sensitive files, or exfiltrate data from your server. If you use Apache OFBiz 24.09 before 24.09.08, an attacker could trick your server into making unauthorized requests to internal or external endpoints, leading to data breaches or further compromise of your infrastructure.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements or HIPAA's safeguards for protected health information. A breach resulting from this flaw may result in legal penalties, reputational damage, and loss of trust due to non-compliance with these regulations.

Mitigation Strategies

Upgrade Apache OFBiz to version 24.09.08 or later. Remove or restrict catalog permissions for users who do not need them. Review and validate all survey template URLs to ensure they point to trusted locations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-81828. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...