The vulnerability is a code injection flaw that lets a low-privileged authenticated user with the ability to edit Content/DataResource objects inject arbitrary FreeMarker template code. Such injected code can be executed by the OFBiz application engine, providing the attacker with the ability to run system commands, exfiltrate data, or otherwise compromise the host. The flaw is a direct instance of improper code generation, which falls under the identified weakness category.

Affected installations are those running Apache OFBiz earlier than version 24.09.07 from the Apache Software Foundation. Any deployment retaining those legacy releases and granting content or data‑resource editing rights to users who are not fully trusted falls within the risk window. The vendor lists all pre‑24.09.07 builds as vulnerable.

No EPSS entry is published, and the vulnerability is not in the CISA KEV catalog, but the absence of these metrics does not diminish the severity, especially given the confirmed remote code execution capability. The threat model requires an authenticated user with moderate privileges; therefore, the exploit is relatively low in effort but high in impact. The best posture for the environment is to promptly remediate with the vendor’s patch to eliminate the code execution pathway.