CVE-2026-31380
Modified Modified - Updated After Analysis
Expression Language Injection in Apache OFBiz

Publication date: 2026-05-19

Last updated on: 2026-05-19

Assigner: Apache Software Foundation

Description
Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-19
Last Modified
2026-05-19
Generated
2026-06-10
AI Q&A
2026-05-19
EPSS Evaluated
2026-06-08
NVD
CVE-2026-31380
EUVD
EUVD-2026-30862
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
apache ofbiz to 24.09.06 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-917 The product constructs all or part of an expression language (EL) statement in a framework such as a Java Server Page (JSP) using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended EL statement before it is executed.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is an Improper Neutralization of Special Elements used in an Expression Language Statement, also known as Expression Language Injection, in Apache OFBiz.

It occurs when special elements in an expression language are not properly neutralized, which can allow an attacker to inject malicious expressions.

This issue affects Apache OFBiz versions before 24.09.06.

Impact Analysis

Exploitation of this vulnerability could allow an attacker to execute unauthorized expressions within the application, potentially leading to unauthorized actions or data exposure.

This could compromise the integrity and security of the affected Apache OFBiz system.

Mitigation Strategies

The recommended immediate step to mitigate this vulnerability is to upgrade Apache OFBiz to version 24.09.06 or later, as this version contains the fix for the Expression Language Injection issue.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-31380. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart