CVE-2026-31380
Expression Language Injection in Apache OFBiz
Publication date: 2026-05-19
Last updated on: 2026-05-19
Assigner: Apache Software Foundation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| apache | ofbiz | to 24.09.06 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-917 | The product constructs all or part of an expression language (EL) statement in a framework such as a Java Server Page (JSP) using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended EL statement before it is executed. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an Improper Neutralization of Special Elements used in an Expression Language Statement, also known as Expression Language Injection, in Apache OFBiz.
It occurs when special elements in an expression language are not properly neutralized, which can allow an attacker to inject malicious expressions.
This issue affects Apache OFBiz versions before 24.09.06.
How can this vulnerability impact me? :
Exploitation of this vulnerability could allow an attacker to execute unauthorized expressions within the application, potentially leading to unauthorized actions or data exposure.
This could compromise the integrity and security of the affected Apache OFBiz system.
What immediate steps should I take to mitigate this vulnerability?
The recommended immediate step to mitigate this vulnerability is to upgrade Apache OFBiz to version 24.09.06 or later, as this version contains the fix for the Expression Language Injection issue.