The vulnerability in Apache OFBiz arises from improper handling of input parameters in FreeMarker templates, allowing an attacker to inject arbitrary FreeMarker expressions. When an attacker supplies a crafted value for a duplicated parameter, the sanitization step can be bypassed, enabling the template engine to evaluate malicious code. Based on the description, it is inferred that the injected expression may enable an attacker to compromise the application’s security posture.

Products affected are Apache OFBiz versions prior to 24.09.06. All deployments using those releases are vulnerable until the application is upgraded to 24.09.06 or later, where the fix was implemented.

The CVSS score is 6.5, the EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog, suggesting current exploitation activity is unknown. Based on the description, it is inferred that attackers would need to supply malicious input to a user‑controllable field that is rendered in a FreeMarker template. If the application exposes such a field without proper authorization checks, exploitation can occur with minimal prerequisites.