CVE-2025-26865
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
10/03/2025
Last modified:
23/06/2025
Description
Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz.<br />
<br />
This issue affects Apache OFBiz: from 18.12.17 before 18.12.18. <br />
<br />
It&#39;s a regression between 18.12.17 and 18.12.18.<br />
In case you use something like that, which is not recommended!<br />
For security, only official releases should be used.<br />
<br />
In other words, if you use 18.12.17 you are still safe.<br />
The version 18.12.17 is not a affected.<br />
But something between 18.12.17 and 18.12.18 is.<br />
<br />
In that case, users are recommended to upgrade to version 18.12.18, which fixes the issue.
Impact
Base Score 3.x
3.50
Severity 3.x
LOW
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:a:apache:ofbiz:18.12.17:*:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page