Apache OFBiz 24.09 prior to 24.09.08 contains a server‑side template injection that permits an authenticated non‑administrative user to execute arbitrary operating system commands. The flaw is located in the updateLayoutImage event, which writes DataResource fields without a permission check. An attacker can create a DataResource referencing an FTL template; when the template engine evaluates its own primary key, unsandboxed Groovy code embedded in the use‑when attribute runs, leading to full OS command execution as the OFBiz process user.

The affected product is Apache OFBiz version 24.09 and earlier releases up to 24.09.07 on all supported platforms. The issue only manifests for users with a standard account that can invoke the updateLayout event. No other products or later versions are impacted.

The vulnerability is exploitable only by authenticated users with standard access rights to the application. While the CVSS score is not publicly documented, the requirement of only ordinary credentials and the ability to run system commands yields a high risk. No EPSS data or KEV listing indicates that public exploitation is not yet widespread, yet the potential impact remains significant for unpatched installations. An attacker could trigger the flaw by sending crafted image update requests or by uploading a benign image that carries the malicious template payload.