RenderLink concatenates user supplied link parameter values directly into unquoted, unescaped template source. This creates a Server‑Side Template Injection flaw that allows a remote authenticated attacker to inject FreeMarker expressions, leading to the execution of arbitrary operating system commands as the OFBiz service account with a single GET request.

All Apache OFBiz installations running version 24.09 before 24.09.08 on any platform are affected. The vulnerability is present on all operating systems where OFBiz runs and can be triggered by users who have the two view permissions of a control‑servlet webapp, such as CATALOG_VIEW and OFBTOOLS_VIEW.

The CVSS score of 8.8 classifies this as a high‑severity vulnerability that requires only authentication to two default view permissions and allows unrestricted command execution. Because it can be triggered by a single HTTP GET request, the attack surface is large and the exploitability is high. The CVE is not listed in CISA KEV and no EPSS score is available, but the impact on confidentiality, integrity, and availability of the affected system is severe.