CVE-2026-29226

CVE-2026-29226: Apache OFBiz: Low-Privilege SSRF in Content Component

Vendor Apache Software Foundation

Product Apache OFBiz

Weakness CWE-918 · SSRF

Published May 19, 2026

Last update May 19, 2026

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Server-Side Request Forgery (SSRF) vulnerability in Apache OFBiz via Content component operations. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue.

Key dates

02Disclosure timeline

May 19, 2026 CVE published

May 19, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-29226 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/918.html AskarLabs — CWE-918 write-up Server-Side Request Forgery

Related vulnerabilities

04Related CVE

CVE-2025-60175 WordPress PopAd Plugin <= 1.0.4 - Server Side Request Forgery (SSRF) Vulnerability CVE-2026-57681 WordPress GeoDirectory plugin <= 2.8.161 - Server Side Request Forgery (SSRF) vulnerability CVE-2026-0686 Webmention <= 5.6.2 - Unauthenticated Blind Server-Side Request Forgery CVE-2026-66654 WordPress Vehica Core plugin <= 1.0.104 - Server Side Request Forgery (SSRF) vulnerability CVE-2026-65467 WordPress JetEngine plugin <= 3.8.11 - Server Side Request Forgery (SSRF) vulnerability