---
id: "CVE-2026-82902"
kind: "vulnerability"
aliases: ["CVE-2026-82902"]
title: "Apache OFBiz: viewdatafile screen lets logged-in users make server fetch URLs and read files"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["apache-ofbiz", "java", "package", "self-hosted"]
not_affected_if: ["versions-24.09.08-or-later"]
published_at: "2026-11-05T14:17:05+00:00"
first_seen_at: "2026-11-05T14:39:18+00:00"
updated_at: "2026-11-05T14:40:44+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82902", "first_seen_at": "2026-11-05T14:39:18+00:00"}]
exploit_sources: []
---

# Apache OFBiz: viewdatafile screen lets logged-in users make server fetch URLs and read files

A logged-in user with the WebTools view permission can make the OFBiz server send requests to arbitrary URLs by supplying a parameter to the viewdatafile screen. An attacker who also holds entity and datafile maintenance permissions can read arbitrary local files through a file: URL.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed OFBiz version; affected releases are 24.09 before `24.09.08`.
- Look for the `viewdatafile` screen and `ViewDataFile.groovy` in the deployed OFBiz webtools component.

## Fix

- Apache OFBiz 24.09 series: upgrade to `24.09.08`.

## Timeline

- 2026-11-05T14:39:18+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-82902

## From the sources

Server-Side Request Forgery in ViewDataFile in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only the base webtools permissions (OFBTOOLS_VIEW, WEBTOOLS_VIEW) to cause the server to issue arbitrary outbound HTTP requests, and an attacker additionally holding ENTITY_MAINT and DATAFILE_MAINT to read arbitrary local files via a file: URL, by supplying the DEFINITION_LOCATION or DATAFILE_LOCATION request parameter to the viewdatafile screen, because ViewDataFile.groovy dereferences both parameters as java.net.URL objects with no scheme allow-list, host filter, or egress control inside a screen action that runs before the screen's and template's permission checks are evaluated, so the fetch executes regardless of whether the requesting account is authorized to view its result. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_