A vulnerability was identified in OpenBoxes up to 0.9.6. This impacts the function buildZebraTemplate of the file grails-app/controllers/org/pih/warehouse/core/DocumentController.groovy of the component Template Processing. The manipulation leads to improper neutralization of special elements used in a template engine.
It is possible to initiate the attack remotely. The exploit is publicly available and might be used. Upgrading to version 0.9.8-hotfix1 and 0.9.8 will fix this issue.
The identifier of the patch is deeac6a4a7aba86ce99c4bda37142e41d209293e. It is recommended to upgrade the affected component.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
Low
Partial data leak
Integrity
Low
Partial data modification
Availability
Low
Partial disruption
CVSS Vector v4.0
Weakness Type (CWE)
References 10
https://gist.github.com/nedlir/220a30213b5a5c6bc26d1000012c6a4d
cna@vuldb.com
https://github.com/OpenBoxes/OpenBoxes/
cna@vuldb.com
https://github.com/OpenBoxes/OpenBoxes/pull/5943
cna@vuldb.com
https://github.com/OpenBoxes/OpenBoxes/security/advisories/GHSA-8wxj-vghp-jpcq
cna@vuldb.com
https://github.com/openboxes/openboxes/commit/deeac6a4a7aba86ce99c4bda37142e41d…
cna@vuldb.com
https://github.com/openboxes/openboxes/releases/tag/v0.9.8
cna@vuldb.com
https://vuldb.com/cve/CVE-2026-19929
cna@vuldb.com
https://vuldb.com/submit/872054
cna@vuldb.com
https://vuldb.com/vuln/390180
cna@vuldb.com
https://vuldb.com/vuln/390180/cti
cna@vuldb.com