The vulnerability is an expression language injection in Apache OFBiz 24.09 before 24.09.08. A remote authenticated attacker with only the basic view permissions OFBTOOLS_VIEW and ACCOUNTING_VIEW can supply a Groovy expression inside the bodyText or subject fields of the Send Per Email invoice form. The service passes these values to FlexibleStringExpander.expandString, which compiles the embedded Groovy code without the security restrictions normally applied by GroovyUtil.eval. As a result, the attacker can execute arbitrary operating system commands as the user account that runs the OFBiz application, allowing complete compromise of the system. This is a classic instance of CWE‑917.

Affected systems are any instances of Apache OFBiz version 24.09 running on any supported platform, before the release of 24.09.08. The vulnerability exists in the built‑in EmailServices service used by the send‑mail functionality provided through the Accounting application. No specific operating system or deployment type is excluded; the flaw is inherent to the code base.

The CVSS score of 8.8, combined with no EPSS data and absence from the CISA KEV catalog, indicates a high severity vulnerability that has not yet been widely exploited. The capability requires only authenticated access with minimal privileges and offers remote code execution, which is the highest impact level. Because the privileged permissions required are commonly granted to users who need to process invoices, the attack surface is significant. Until the patch is applied, the vulnerability remains a high‑risk concern for any deployed OFBiz 24.09 instance.