SurveyWrapper.getTemplate accepts an attacker‑supplied template location and pulls the content through URL.openStream() without validating the scheme or host. An authenticated back‑office user with catalog permissions can set any URL, enabling the server to fetch attacker‑controlled content, including internal network resources, cloud‑metadata endpoints, or local files via file://. The retrieved data is compiled as a FreeMarker template and rendered in the shopper’s browser, making the flaw an information‑disclosure channel that can also facilitate further attacks.

Apache OFBiz version 24.09 and earlier up to 24.09.07 on all platforms. The issue is present wherever SurveyWrapper is enabled and requires a back‑office user with catalog permissions.

The flaw is authenticated, requiring catalog permission rather than arbitrary external access, but once exploited it exposes internal assets to an attacker. No EPSS value is available and the vulnerability is not listed in CISA’s KEV catalog, yet the potential for broad internal exposure and malicious rendering warrants high concern. Monitoring for unusual survey template activity and restricting privileged access remains prudent while a patch is applied.