Improper control of code generation in the Apache OFBiz CMS plugin allows an authenticated content‑editor to inject a Groovy expression via the caContentIdTo parameter. The expression is placed into the use‑when attribute of a form field and passed unvalidated to GroovyUtil.eval, which ignores the sandbox’s reflection restrictions. The attacker can close the string literal, invoke java.lang.Runtime through reflection, and execute arbitrary OS commands as the OFBiz process user.

The vulnerability affects Apache OFBiz through version 24.09.07 and earlier. Any deployment of this CMS plugin that has not been upgraded to 24.09.08 or later is susceptible. The issue exists on all platforms supported by the OFBiz distribution.

The CVSS score is not provided, and the EPSS score is unavailable, so the exact likelihood of exploitation is unknown. However, the flaw requires only legitimate CMS content‑editor credentials and a single HTTP POST request to EditAddContent, making it relatively easy for an attacker with such access to trigger. The vulnerability enables execution of arbitrary system commands, giving full control over the server as the OFBiz user. The flaw is not listed in CISA’s KEV catalog, but its impact is severe.