CVE-2026-19929

OpenBoxes Template Processing DocumentController.groovy buildZebraTemplate special elements in template engine

State: Published
Severity: 5.3 Medium
Published: Aug 16, 2026
Updated: Aug 19, 2026
Reserved: Aug 15, 2026

Description

A vulnerability was identified in OpenBoxes up to 0.9.6. This impacts the function buildZebraTemplate of the file grails-app/controllers/org/pih/warehouse/core/DocumentController.groovy of the component Template Processing. The manipulation leads to improper neutralization of special elements used in a template engine. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. Upgrading to version 0.9.8-hotfix1 and 0.9.8 will fix this issue. The identifier of the patch is deeac6a4a7aba86ce99c4bda37142e41d209293e. It is recommended to upgrade the affected component.

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P	VulDB
3.1	6.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C	VulDB
3.0	6.3 Medium	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C	VulDB
2.0	6.5 Medium	AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C	VulDB

Weaknesses

CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine
CWE-791 Incomplete Filtering of Special Elements

Affected Products

Product	Versions
OpenBoxesn/a	0.9.0Affected 0.9.1Affected 0.9.2Affected 0.9.3Affected 0.9.4Affected 0.9.5Affected 0.9.6Affected 0.9.8-hotfix1Not affected 0.9.8Not affected

References

VDB-390180 | OpenBoxes Template Processing DocumentController.groovy buildZebraTemplate special elements in template enginevdb-entrytechnical-description
VDB-390180 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
CVE-2026-19929 | CVE Analysis and Reportthird-party-advisory
Submit #872054 | Openboxes v0.9.7 Command Injectionthird-party-advisory
https://github.com/OpenBoxes/OpenBoxes/security/advisories/GHSA-8wxj-vghp-jpcqrelated
https://github.com/OpenBoxes/OpenBoxes/pull/5943issue-trackingpatch
https://gist.github.com/nedlir/220a30213b5a5c6bc26d1000012c6a4dexploit
https://github.com/openboxes/openboxes/commit/deeac6a4a7aba86ce99c4bda37142e41d209293epatch
https://github.com/openboxes/openboxes/releases/tag/v0.9.8patch
https://github.com/OpenBoxes/OpenBoxes/product

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.