CVE-2026-31380
Modified Modified - Updated After Analysis

Expression Language Injection in Apache OFBiz

Publication date: 2026-05-19

Last updated on: 2026-05-19

Assigner: Apache Software Foundation

Description
Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-05-19
Last Modified
2026-05-19
Generated
2026-06-30
AI Q&A
2026-05-19
EPSS Evaluated
2026-06-28
NVD
CVE-2026-31380
EUVD
EUVD-2026-30862

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
apache ofbiz to 24.09.06 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-917 The product constructs all or part of an expression language (EL) statement in a framework such as a Java Server Page (JSP) using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended EL statement before it is executed.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Improper Neutralization of Special Elements used in an Expression Language Statement, also known as Expression Language Injection, in Apache OFBiz.

It occurs when special elements in an expression language are not properly neutralized, which can allow an attacker to inject malicious expressions.

This issue affects Apache OFBiz versions before 24.09.06.

Impact Analysis

Exploitation of this vulnerability could allow an attacker to execute unauthorized expressions within the application, potentially leading to unauthorized actions or data exposure.

This could compromise the integrity and security of the affected Apache OFBiz system.

Mitigation Strategies

The recommended immediate step to mitigate this vulnerability is to upgrade Apache OFBiz to version 24.09.06 or later, as this version contains the fix for the Expression Language Injection issue.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-31380. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart