CVE-2025-26865 PoC — Apache OFBiz: Server-Side Template Injection affecting the ecommerce plugin leading to possible RCE

Source

https://github.com/mbadanoiu/CVE-2025-26865

Associated Vulnerability

Title:Apache OFBiz: Server-Side Template Injection affecting the ecommerce plugin leading to possible RCE (CVE-2025-26865)
Description:Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz. This issue affects Apache OFBiz: from 18.12.17 before 18.12.18. It's a regression between 18.12.17 and 18.12.18. In case you use something like that, which is not recommended! For security, only official releases should be used. In other words, if you use 18.12.17 you are still safe. The version 18.12.17 is not a affected. But something between 18.12.17 and 18.12.18 is. In that case, users are recommended to upgrade to version 18.12.18, which fixes the issue.

Description

CVE-2025-26865: FreeMarker Server-Side Template Injection via the "ecommerce" plugin in Apache OfBiz

Readme

# CVE-2025-26865: FreeMarker Server-Side Template Injection via the "ecommerce" plugin in Apache OfBiz

Due to a regression between 18.12.17 and 18.12.18 the fix for finding [CVE-2022-25813: FreeMarker Server-Side Template Injection in Apache OfBiz](https://github.com/mbadanoiu/CVE-2022-25813) was no longer enforced which reopened the possibility of launching FreeMarker Server-Side Template Injection (SSTI) attacks by leveraging the "ecommerce" plugin.

If the attack is successful, the SSTI may result in Remote Code Execution (RCE).

### Vendor Disclosure:

The vendor's disclosure and fix for this vulnerability can be found [here](https://lists.apache.org/thread/prb48ztk01bflyyjbl6p56wlcc1n5sz7).

### Requirements:

This vulnerability requires:
<br/>
- Registering a new user or valid user credentials
- User interaction of a administrative user

### Proof Of Concept:

As this attack is a exact re-creation of CVE-2022-25813, more details and the exploitation process can be found in this [PDF](https://github.com/mbadanoiu/CVE-2022-25813/blob/main/Apache%20OfBiz%20-%20CVE-2022-25813.pdf).

### Additional Resources:

Original SSTI finding in Apache OfBiz: [CVE-2022-25813: FreeMarker Server-Side Template Injection in Apache OfBiz](https://github.com/mbadanoiu/CVE-2022-25813)

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!