VulnerabilityModified

CVE-2026-31380

Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in Apache OFBiz.

MEDIUM 6.5EPSS 0.49%

Does this matter?

Lower severity and a low EPSS score (0.49%). Track it; it rarely justifies an emergency change on its own.

Description

Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.

CVSS 3.1: 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
EPSS: 0.49% probability · 41th percentile
CISA KEV: Not listed
Weakness: CWE-917
Affected: apache/ofbiz
Source: security@apache.org

References

https://lists.apache.org/thread/v2brvq1tf4q491obkxv8p7fc5qfshc08Mailing List, Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/05/19/19

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.