CVE-2025-26865: FreeMarker Server-Side Template Injection via the "ecommerce" plugin in Apache OfBiz

Due to a regression between 18.12.17 and 18.12.18 the fix for finding CVE-2022-25813: FreeMarker Server-Side Template Injection in Apache OfBiz was no longer enforced which reopened the possibility of launching FreeMarker Server-Side Template Injection (SSTI) attacks by leveraging the "ecommerce" plugin.

If the attack is successful, the SSTI may result in Remote Code Execution (RCE).

Vendor Disclosure:

The vendor's disclosure and fix for this vulnerability can be found here.

Requirements:

This vulnerability requires:

• Registering a new user or valid user credentials
• User interaction of a administrative user

Proof Of Concept:

As this attack is a exact re-creation of CVE-2022-25813, more details and the exploitation process can be found in this PDF.

Additional Resources:

Original SSTI finding in Apache OfBiz: CVE-2022-25813: FreeMarker Server-Side Template Injection in Apache OfBiz