The issue arises from the Apache OFBiz email services’ use of unsafe template expansion, leading to improper code generation. Based on the description, it is inferred that the vulnerability requires authentication, allowing an attacker who can log in to inject and execute arbitrary code on the server. The weakness is identified as a Code Injection vulnerability (CWE‑94). As a result, a compromise would allow full control of the affected system, including data exfiltration, modification, or further lateral movement.

This vulnerability affects the Apache OFBiz product distributed by the Apache Software Foundation. All releases before version 24.09.06 are impacted. The fix is included in version 24.09.06 and later.

The CVSS score of 6.5 indicates moderate severity. The EPSS score is reported as <1%, implying a very low probability of exploitation. The vulnerability is not listed in CISA's KEV catalog. Attackers still require authenticated access to the system; upon login they can craft a malicious template that will be expanded and executed on the server. While exploitation evidence is lacking, the combination of moderate severity and the potential to compromise the system fully means organizations should treat the vulnerability as significant and respond promptly.