CVE-2026-29207
Medium · 6.5CVSS
6.5
EPSS
0.6%
Published
May 19, 2026
CISA due date
—
The record
Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue. Please note that in the updated version, "Data Resource" records with dataTemplateTypeId = "FTL" are no longer supported. Additionally, in the updated version, the "Ecommerce Customer" security group no longer includes content management grants. Users are advised to remove these permissions from any production site as well.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-96392 Improper Neutralization of Special Elements Used in a Template Engine vulnerability in… CWE-1336
- CVE-2026-96355 Improper Neutralization of Special Elements Used in a Template Engine vulnerability in… CWE-1336
- CVE-2026-104851 fsspec is a specification and Python implementation framework for filesystem interfaces. CWE-1336
- CVE-2026-9160 Improper neutralization of special elements used in a template engine vulnerability in… CWE-1336
- CVE-2026-19584 Velociraptor allows for the creation of notebook backups in its default enabled daily… CWE-1336
- CVE-2026-75650 Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a… CWE-1336
- CVE-2026-52762 YesWiki is a wiki system written in PHP. CWE-1336
- CVE-2026-85654 Improper neutralization of special elements used in a template engine in the CDK… CWE-1336