The issue arises from the Apache OFBiz email services’ use of unsafe template expansion, leading to improper code generation. Based on the description, it is inferred that the vulnerability requires authentication, allowing an attacker who can log in to inject and execute arbitrary code on the server. The weakness is identified as a Code Injection vulnerability (CWE‑94). As a result, a compromise would allow full control of the affected system, including data exfiltration, modification, or further lateral movement.

This vulnerability affects the Apache OFBiz product distributed by the Apache Software Foundation. All releases before version 24.09.06 are impacted. The fix is included in version 24.09.06 and later.

No EPSS data or KEV listing is available, and the CVSS score is not published. Based on the description, it is inferred that the attack requires authenticated users or a successful login. Once authenticated, an attacker can supply a crafted template to trigger code execution. The lack of public exploit evidence suggests the threat is moderate to high, but organizations should treat the vulnerability as significant due to the potential for complete system takeover.