{"id":"CVE-2026-68524","kind":"vulnerability","aliases":["CVE-2026-68524"],"related":[],"title":"Apache OFBiz: temporary-file handling lets unauthenticated attackers load malicious screens","description":"An unauthenticated attacker can exploit temporary-file handling, access an open file descriptor, and inject a \"file:\" URI to cause OFBiz to load an attacker-controlled Screen definition.\n\n\n\nThis issue affects Apache OFBiz: before 24.09.08.\n\n\n\nUsers are recommended to upgrade to version 24.09.08, which fixes the issue.","summary":"Apache OFBiz can be made to load a Screen definition the attacker controls, by abusing temporary-file handling, an open file descriptor and a crafted file: URI. The sources do not state the full outcome, but loading an attacker-controlled screen definition can lead to code execution on the server.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-ofbiz","java","package","self-hosted"],"not_affected_if":["version-24.09.08-or-later"],"how_to_check":"- Check the Apache OFBiz version in use; versions before `24.09.08` are affected.","fix":"- Apache OFBiz: upgrade to `24.09.08`","status":"open","published_at":"2026-11-05T15:17:22+00:00","first_seen_at":"2026-11-05T15:39:21+00:00","triaged_at":"2026-11-05T15:41:02+00:00","updated_at":"2026-11-05T15:41:02+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-05T15:41:02Z","model":"claude-haiku-5-5","output":{"fix":"- Apache OFBiz: upgrade to `24.09.08`","reach":"internet","title":"Apache OFBiz: temporary-file handling lets unauthenticated attackers load malicious screens","impact":"high","summary":"Apache OFBiz can be made to load a Screen definition the attacker controls, by abusing temporary-file handling, an open file descriptor and a crafted file: URI. The sources do not state the full outcome, but loading an attacker-controlled screen definition can lead to code execution on the server.","audience":"businesses","category":"package","nicknames":[],"who_cares":["apache-ofbiz","java","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"attacker loads own screen definition, possibly running code on server","analyst_note":"Confirm the exact impact of loading an attacker-controlled Screen definition and whether the NVD entry lists a CVSS score; source gave no severity.","how_to_check":"- Check the Apache OFBiz version in use; versions before `24.09.08` are affected.\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["version-24.09.08-or-later"],"who_is_affected":"Teams running Apache OFBiz versions before 24.09.08 that accept requests from the network. The sources do not describe further configuration conditions.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000676,"input_tokens":4233,"output_tokens":506,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-68524':15A,18A '24.09.08':115C,123C 'abus':41B 'access':88C 'affect':111C 'apach':1A,20B,27B,112C 'apache-ofbiz':19B 'attack':9A,38B,67B,81C,105C 'attacker-control':66B,104C 'caus':99C 'code':74B 'control':39B,68B,106C 'craft':52B 'cve':13A,16A 'definit':36B,70B,108C 'descriptor':49B,92C 'execut':75B 'exploit':83C 'file':5A,44B,48B,53B,86C,91C,96C 'fix':125C 'full':61B 'handl':6A,45B,87C 'host':26B 'inject':94C 'issu':110C,127C 'java':22B 'lead':72B 'let':7A 'load':10A,33B,64B,102C 'made':31B 'malici':11A 'ofbiz':2A,21B,28B,100C,113C 'open':47B,90C 'outcom':62B 'packag':23B 'recommend':118C 'screen':12A,35B,69B,107C 'self':25B 'self-host':24B 'server':78B 'sourc':56B 'state':59B 'temporari':4A,43B,85C 'temporary-fil':3A,42B,84C 'unauthent':8A,80C 'upgrad':120C 'uri':54B,97C 'user':116C 'version':122C","nicknames":[],"mitigations":[],"who_affected":"Teams running Apache OFBiz versions before 24.09.08 that accept requests from the network. The sources do not describe further configuration conditions.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apacheofbiz","high","java","package","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-05T15:17:22+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-68524","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68524","severity":null,"published_at":"2026-11-05T15:17:22+00:00","modified_at":"2026-11-05T15:17:22+00:00","first_seen_at":"2026-11-05T15:39:21+00:00","fetched_at":"2026-11-05T15:39:21+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}