CVE-2026-82912 | Apache OFBiz up to 24.09.07 EmailServices FlexibleStringExpander.expandString bodyText/subject code injection

November 5, 2026 Yanac

A vulnerability, which was classified as critical, was found in Apache OFBiz up to 24.09.07. Affected by this issue is the function FlexibleStringExpander.expandString of the component EmailServices. The manipulation of the argument bodyText/subject results in code injection.

This vulnerability is cataloged as CVE-2026-82912. The attack may be launched remotely. There is no exploit available.

You should upgrade the affected component.VulDB Recent EntriesRead More