{"id":"CVE-2026-82902","kind":"vulnerability","aliases":["CVE-2026-82902"],"related":[],"title":"Apache OFBiz: viewdatafile screen lets logged-in users make server fetch URLs and read files","description":"Server-Side Request Forgery in ViewDataFile in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only the base webtools permissions (OFBTOOLS_VIEW, WEBTOOLS_VIEW) to cause the server to issue arbitrary outbound HTTP requests, and an attacker additionally holding ENTITY_MAINT and DATAFILE_MAINT to read arbitrary local files via a file: URL, by supplying the DEFINITION_LOCATION or DATAFILE_LOCATION request parameter to the viewdatafile screen, because ViewDataFile.groovy dereferences both parameters as java.net.URL objects with no scheme allow-list, host filter, or egress control inside a screen action that runs before the screen's and template's permission checks are evaluated, so the fetch executes regardless of whether the requesting account is authorized to view its result. Users are recommended to upgrade to version 24.09.08, which fixes this issue.","summary":"A logged-in user with the WebTools view permission can make the OFBiz server send requests to arbitrary URLs by supplying a parameter to the viewdatafile screen. An attacker who also holds entity and datafile maintenance permissions can read arbitrary local files through a file: URL.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-ofbiz","java","package","self-hosted"],"not_affected_if":["versions-24.09.08-or-later"],"how_to_check":"- Check the installed OFBiz version; affected releases are 24.09 before `24.09.08`.\n- Look for the `viewdatafile` screen and `ViewDataFile.groovy` in the deployed OFBiz webtools component.","fix":"- Apache OFBiz 24.09 series: upgrade to `24.09.08`.","status":"open","published_at":"2026-11-05T14:17:05+00:00","first_seen_at":"2026-11-05T14:39:18+00:00","triaged_at":"2026-11-05T14:40:44+00:00","updated_at":"2026-11-05T14:40:44+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-05T14:40:44Z","model":"claude-haiku-5-5","output":{"fix":"- Apache OFBiz 24.09 series: upgrade to `24.09.08`.","reach":"network","title":"Apache OFBiz: viewdatafile screen lets logged-in users make server fetch URLs and read files","impact":"medium","summary":"A logged-in user with the WebTools view permission can make the OFBiz server send requests to arbitrary URLs by supplying a parameter to the viewdatafile screen. An attacker who also holds entity and datafile maintenance permissions can read arbitrary local files through a file: URL.","audience":"businesses","category":"package","nicknames":[],"who_cares":["apache-ofbiz","self-hosted","java"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"server fetches internal URLs and reads local files","analyst_note":"","how_to_check":"- Check the installed OFBiz version; affected releases are 24.09 before `24.09.08`.\n- Look for the `viewdatafile` screen and `ViewDataFile.groovy` in the deployed OFBiz webtools component.","plain_action":"","needs_analyst":false,"not_affected_if":["versions-24.09.08-or-later"],"who_is_affected":"Teams running Apache OFBiz 24.09 releases before 24.09.08 on any platform. Exposure is greatest where accounts with the WebTools view permission exist and the server can reach internal networks or local files. Instances on other OFBiz versions are not stated as affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000721,"input_tokens":4475,"output_tokens":547,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':18A,21A '-82902':19A,22A '24.09':88C '24.09.08':90C,211C 'account':197C 'action':174C 'addit':122C 'allow':94C,164C 'allow-list':163C 'also':62B 'apach':1A,24B,86C 'apache-ofbiz':23B 'arbitrari':49B,71B,115C,131C 'attack':60B,98C,121C 'authent':97C 'author':199C 'base':102C 'caus':110C 'check':185C 'control':170C 'cve':17A,20A 'datafil':66B,127C,144C 'definit':141C 'derefer':154C 'egress':169C 'entiti':64B,124C 'evalu':187C 'execut':191C 'fetch':12A,190C 'file':16A,73B,76B,133C,136C 'filter':167C 'fix':213C 'forgeri':82C 'hold':63B,99C,123C 'host':30B,166C 'http':117C 'insid':171C 'issu':114C,215C 'java':26B 'java.net.url':158C 'let':5A 'list':165C 'local':72B,132C 'locat':142C,145C 'log':7A,33B 'logged-in':6A,32B 'maint':125C,128C 'mainten':67B 'make':10A,42B 'object':159C 'ofbiz':2A,25B,44B,87C 'ofbtool':105C 'outbound':116C 'packag':27B 'paramet':54B,147C,156C 'permiss':40B,68B,104C,184C 'platform':93C 'read':15A,70B,130C 'recommend':206C 'regardless':192C 'remot':96C 'request':47B,81C,118C,146C,196C 'result':203C 'run':176C 'scheme':162C 'screen':4A,58B,151C,173C,179C 'self':29B 'self-host':28B 'send':46B 'server':11A,45B,79C,112C 'server-sid':78C 'side':80C 'suppli':52B,139C 'templat':182C 'upgrad':208C 'url':13A,50B,77B,137C 'user':9A,35B,204C 'version':210C 'via':134C 'view':39B,106C,108C,201C 'viewdatafil':3A,57B,84C,150C 'viewdatafile.groovy':153C 'webtool':38B,103C,107C 'whether':194C","nicknames":[],"mitigations":[],"who_affected":"Teams running Apache OFBiz 24.09 releases before 24.09.08 on any platform. Exposure is greatest where accounts with the WebTools view permission exist and the server can reach internal networks or local files. Instances on other OFBiz versions are not stated as affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apacheofbiz","high","java","package","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-05T14:17:05+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-82902","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82902","severity":null,"published_at":"2026-11-05T14:17:05+00:00","modified_at":"2026-11-05T14:17:05+00:00","first_seen_at":"2026-11-05T14:39:18+00:00","fetched_at":"2026-11-05T14:39:18+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}