{"cve":"CVE-2025-26865","nvd":{"published":"2025-03-10T14:15:25.220","modified":"2026-06-17T09:02:30.740","status":"Analyzed","description":"Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz.\n\nThis issue affects Apache OFBiz: from 18.12.17 before 18.12.18.  \n\nIt's a regression between 18.12.17 and 18.12.18.\nIn case you use something like that, which is not recommended!\nFor security, only official releases should be used.\n\nIn other words, if you use 18.12.17 you are still safe.\nThe version 18.12.17 is not a affected.\nBut something between 18.12.17 and 18.12.18 is.\n\nIn that case, users are recommended to upgrade to version 18.12.18, which fixes the issue.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","score":3.5},"cwes":["CWE-1336"],"references":["https://issues.apache.org/jira/browse/OFBIZ-12594","https://lists.apache.org/thread/prb48ztk01bflyyjbl6p56wlcc1n5sz7","https://ofbiz.apache.org/download.html","https://ofbiz.apache.org/security.html","http://www.openwall.com/lists/oss-security/2025/03/07/1"],"products":["apache:ofbiz"],"source":"nvd","synced_at":"2026-10-19T22:00:17.429720821+00:00"},"epss":{"cve":"CVE-2025-26865","score":0.00666,"percentile":0.51833,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}