Apache OFBiz’s ContentWorker module is vulnerable to XML External Entity injection. An authenticated user with content‑author privileges can store a crafted XML DataResource that declares an external entity. When the content is rendered via renderContentAsText or similar CMS/help routes, FreeMarker’s default XML parser is used without security features such as FEATURE_SECURE_PROCESSING or DTD restrictions. This allows the attacker to read arbitrary files on the server or to trigger server‑side request forgery, exposing sensitive data or interacting with internal services. The weakness is identified as CWE‑611.

All platforms running Apache OFBiz 24.09 before 24.09.08 are affected. The vulnerability exists in every 24.09 build older than 24.09.08, regardless of operating system.

The CVSS score is not publicly available. EPSS is not available, and the vulnerability is not listed in CISA KEV, indicating no known exploits. The attack requires authenticated access with content‑author privileges. Once that precondition is satisfied, the attacker can read arbitrary files or induce SSRF. The risk to confidentiality and availability is significant for environments that allow authenticated content authors to create or modify XML DataResource content.