CVE-2026-29226

Published: May 19, 2026Modified: Jun 17, 2026

7.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Exploitability: 3.9 / Impact: 3.4

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Server-Side Request Forgery (SSRF) vulnerability in Apache OFBiz via Content component operations. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.

Affected (1)

Products: Apache: Ofbiz

Apache

1 product

Ofbiz

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apache Ofbiz	Before 24.09.06

Related CWEs

CWE-918

Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

References (2)

https://lists.apache.org/thread/6707wys8jxzmowxggn4cmtwwk9ygl2tr

Source: security@apache.org

Mailing ListVendor Advisory

http://www.openwall.com/lists/oss-security/2026/05/19/16

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.