{"id":"CVE-2026-83542","kind":"vulnerability","aliases":["CVE-2026-83542"],"related":[],"title":"Apache OFBiz: unauthenticated uploads let remote attackers run code on server","description":"Improper Control of Generation of Code ('Code Injection') in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to execute arbitrary code on the server by staging crafted widget XML in a multipart upload and overriding the mainDecoratorLocation used by a manager login route through an anonymous JSON request, causing OFBiz to load the staged XML through its live screen descriptor mechanism and evaluate an unsandboxed Groovy expression while rendering the authentication-failure page. Further validation established the following:\n\n-- The exploit does not require a malformed or incomplete multipart body: a well-formed multipart request that is kept in flight and then allowed to complete normally is sufficient.\n\n-- The screen loader reads the widget XML from a live process file descriptor while the upload is streaming, rather than from any file the attacker persists to disk.\n\n-- The same underlying issue is also reachable through the public, explicitly unauthenticated /sfa/control/editPortalPageColumnWidth route, returning command output directly in an HTTP 200 response — it is not limited to the login-failure rendering path used in the original report.\n\nUsers are recommended to upgrade to version 24.09.08, which fixes this issue.","summary":"Apache OFBiz 24.09 before 24.09.08 lets an unauthenticated remote attacker stage crafted widget XML in a multipart upload, which OFBiz then evaluates as unsandboxed Groovy. The attacker gets arbitrary code execution on the server, and the same flaw is reachable through a public route that returns command output.","severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Apache OFBiz","fixed":["24.09.08"],"affected":"< 24.09.08","ecosystem":"maven"}],"ecosystems":[],"tags":["apache-ofbiz","erp","java","package","self-hosted"],"not_affected_if":["network-restricted","not-24.09-series"],"how_to_check":"Check your OFBiz version (release tag or build in your deployment). Any release before 24.09.08 is listed as affected by the vendor. The vendor does not name a configuration that avoids it. Also check any other OFBiz branch you run (e.g. 18.12.x): the vendor lists only releases before 24.09.08 for this CVE, so confirm with the project.","fix":"Upgrade Apache OFBiz to 24.09.08 (vendor: all releases before 24.09.08 are affected).","status":"open","published_at":"2026-11-05T14:17:06+00:00","first_seen_at":"2026-11-05T14:39:19+00:00","triaged_at":"2026-11-05T14:40:35+00:00","updated_at":"2026-11-05T14:41:46+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-05T14:40:35Z","model":"claude-haiku-5-5","output":{"fix":"- Apache OFBiz: upgrade to `24.09.08`.","reach":"internet","title":"Apache OFBiz: unauthenticated uploads let remote attackers run code on server","impact":"high","summary":"Apache OFBiz 24.09 before 24.09.08 lets an unauthenticated remote attacker stage crafted widget XML in a multipart upload, which OFBiz then evaluates as unsandboxed Groovy. The attacker gets arbitrary code execution on the server, and the same flaw is reachable through a public route that returns command output.","audience":"businesses","category":"package","nicknames":[],"who_cares":["apache-ofbiz","java","self-hosted","erp"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Remote attacker runs arbitrary code on the OFBiz server.","analyst_note":"Confirm the affected version range beyond 24.09 and whether a workaround exists before 24.09.08; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-83542.","how_to_check":"- Check the installed OFBiz version and whether it is `24.09.00` through `24.09.07`.\n- Look for OFBiz deployments reachable from the internet that expose the `/sfa/control/editPortalPageColumnWidth` route.","plain_action":"","needs_analyst":true,"not_affected_if":["not-24.09-series","network-restricted"],"who_is_affected":"Teams running Apache OFBiz 24.09 releases before 24.09.08 on any platform, especially if the instance is reachable from the internet. The public route does not require login, so exposure depends on whether the server accepts requests from outside the network. Deployments on other OFBiz versions are outside the stated range.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000779,"input_tokens":4539,"output_tokens":651,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Confirm the affected version range beyond 24.09 and whether a workaround exists before 24.09.08; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-83542.","search":"'-2026':13A,16A '-83542':14A,17A '/sfa/control/editportalpagecolumnwidth':231C '200':240C '24.09':31B,88C '24.09.08':33B,90C,265C 'allow':94C,185C 'also':224C 'anonym':127C 'apach':1A,21B,29B,86C 'apache':18A 'apache-ofbiz':20B 'arbitrari':57B,101C 'attack':7A,38B,55B,98C,215C 'authent':153C 'authentication-failur':152C 'bodi':171C 'caus':130C 'code':9A,58B,82C,83C,102C 'command':75B,234C 'complet':187C 'control':78C 'craft':40B,108C 'cve':12A,15A 'descriptor':141C,203C 'direct':236C 'disk':218C 'erp':23B 'establish':158C 'evalu':50B,144C 'execut':59B,100C 'explicit':229C 'exploit':162C 'express':148C 'failur':154C,250C 'file':202C,213C 'fix':267C 'flaw':66B 'flight':182C 'follow':160C 'form':175C 'generat':80C 'get':56B 'groovi':53B,147C 'host':28B 'http':239C 'improp':77C 'incomplet':169C 'inject':84C 'issu':222C,269C 'java':24B 'json':128C 'kept':180C 'let':5A,34B 'limit':245C 'live':139C,200C 'load':133C 'loader':193C 'login':123C,249C 'login-failur':248C 'maindecoratorloc':118C 'malform':167C 'manag':122C 'mechan':142C 'multipart':45B,113C,170C,176C 'normal':188C 'ofbiz':2A,19A,22B,30B,48B,87C,131C 'origin':256C 'output':76B,235C 'overrid':116C 'packag':25B 'page':155C 'path':252C 'persist':216C 'platform':93C 'process':201C 'public':71B,228C 'rather':209C 'reachabl':68B,225C 'read':194C 'recommend':260C 'remot':6A,37B,96C 'render':150C,251C 'report':257C 'request':129C,177C 'requir':165C 'respons':241C 'return':74B,233C 'rout':72B,124C,232C 'run':8A 'screen':140C,192C 'self':27B 'self-host':26B 'server':11A,62B,105C 'stage':39B,107C,135C 'stream':208C 'suffici':190C 'unauthent':3A,36B,97C,230C 'under':221C 'unsandbox':52B,146C 'upgrad':262C 'upload':4A,46B,114C,206C 'use':119C,253C 'user':258C 'valid':157C 'version':264C 'well':174C 'well-form':173C 'widget':41B,109C,196C 'xml':42B,110C,136C,197C","nicknames":[],"mitigations":[],"who_affected":"Anyone running a self-hosted Apache OFBiz (ERP/e-commerce) release before 24.09.08 whose login page can be reached by an attacker. The vendor describes it as unauthenticated remote code execution via login-page widget injection. Teams not running OFBiz, or already on 24.09.08, can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-05T14:41:46Z","by":"analyst","doc":"https://www.openwall.com/lists/oss-security/2026/11/04/9","run_id":1783},"products":{"at":"2026-11-05T14:41:46Z","by":"analyst","doc":"https://www.openwall.com/lists/oss-security/2026/11/04/9","run_id":1783},"who_affected":{"at":"2026-11-05T14:41:46Z","by":"analyst","doc":"https://www.openwall.com/lists/oss-security/2026/11/04/9","run_id":1783}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["apacheofbiz"],"ptokens":["apache","ofbiz"],"labels":["apacheofbiz","critical","erp","java","package","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-05T14:17:06+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-83542","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83542","severity":null,"published_at":"2026-11-05T14:17:06+00:00","modified_at":"2026-11-05T14:17:06+00:00","first_seen_at":"2026-11-05T14:39:19+00:00","fetched_at":"2026-11-05T14:39:19+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-83542:1783","url":"https://ofbiz.apache.org/security.html","severity":null,"published_at":"2026-11-05T14:41:46+00:00","modified_at":"2026-11-05T14:41:46+00:00","first_seen_at":"2026-11-05T14:41:46+00:00","fetched_at":"2026-11-05T14:41:46+00:00","note":"Vendor page (ofbiz.apache.org/security) and Cappellato's oss-security post: all releases before 24.09.08 affected, fixed in 24.09.08 (PRs #1654, #1653). Neither source documents a workaround or marks it exploited; no PoC found. X not searched. Network restriction of login page is from vuln.today only, not vendor, so workarounds not verified. NVD page did not load.","cites":["https://ofbiz.apache.org/security.html","https://www.openwall.com/lists/oss-security/2026/11/04/9"]}],"documents":[{"id":76985,"url":"https://ofbiz.apache.org/security.html","title":"Apache OFBiz Security - list of known vulnerabilities","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":76987,"url":"https://www.openwall.com/lists/oss-security/2026/11/04/9","title":"Apache OFBiz: CVE Announcements (oss-security, Jacopo Cappellato)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}