---
id: "CVE-2026-83542"
kind: "vulnerability"
aliases: ["CVE-2026-83542"]
title: "Apache OFBiz: unauthenticated uploads let remote attackers run code on server"
severity: "critical"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "Apache OFBiz", "fixed": ["24.09.08"], "affected": "< 24.09.08", "ecosystem": "maven"}]
ecosystems: []
tags: ["apache-ofbiz", "erp", "java", "package", "self-hosted"]
not_affected_if: ["network-restricted", "not-24.09-series"]
published_at: "2026-11-05T14:17:06+00:00"
first_seen_at: "2026-11-05T14:39:19+00:00"
updated_at: "2026-11-05T14:41:46+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-83542", "first_seen_at": "2026-11-05T14:39:19+00:00"}, {"source": "analyst", "url": "https://ofbiz.apache.org/security.html", "first_seen_at": "2026-11-05T14:41:46+00:00", "cites": ["https://ofbiz.apache.org/security.html", "https://www.openwall.com/lists/oss-security/2026/11/04/9"]}]
exploit_sources: []
---

# Apache OFBiz: unauthenticated uploads let remote attackers run code on server

Apache OFBiz 24.09 before 24.09.08 lets an unauthenticated remote attacker stage crafted widget XML in a multipart upload, which OFBiz then evaluates as unsandboxed Groovy. The attacker gets arbitrary code execution on the server, and the same flaw is reachable through a public route that returns command output.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- maven:Apache OFBiz affected < 24.09.08 fixed 24.09.08

## How to check

Check your OFBiz version (release tag or build in your deployment). Any release before 24.09.08 is listed as affected by the vendor. The vendor does not name a configuration that avoids it. Also check any other OFBiz branch you run (e.g. 18.12.x): the vendor lists only releases before 24.09.08 for this CVE, so confirm with the project.

## Fix

Upgrade Apache OFBiz to 24.09.08 (vendor: all releases before 24.09.08 are affected).

## Timeline

- 2026-11-05T14:39:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-83542
- 2026-11-05T14:41:46+00:00 analyst https://ofbiz.apache.org/security.html — Vendor page (ofbiz.apache.org/security) and Cappellato's oss-security post: all releases before 24.09.08 affected, fixed in 24.09.08 (PRs #1654, #1653). Neither source documents a workaround or marks it exploited; no PoC found. X not searched. Network restriction of login page is from vuln.today only, not vendor, so workarounds not verified. NVD page did not load.

## Documents

- [advisory] Apache OFBiz Security - list of known vulnerabilities https://ofbiz.apache.org/security.html
- [advisory] Apache OFBiz: CVE Announcements (oss-security, Jacopo Cappellato) https://www.openwall.com/lists/oss-security/2026/11/04/9

## From the sources

Improper Control of Generation of Code ('Code Injection') in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to execute arbitrary code on the server by staging crafted widget XML in a multipart upload and overriding the mainDecoratorLocation used by a manager login route through an anonymous JSON request, causing OFBiz to load the staged XML through its live screen descriptor mechanism and evaluate an unsandboxed Groovy expression while rendering the authentication-failure page. Further validation established the following:

-- The exploit does not require a malformed or incomplete multipart body: a well-formed multipart request that is kept in flight and then allowed to complete normally is sufficient.

-- The screen loader reads the widget XML from a live process file descriptor while the upload is streaming, rather than from any file the attacker persists to disk.

-- The same underlying issue is also reachable through the public, explicitly unauthenticated /sfa/control/editPortalPageColumnWidth route, returning command output directly in an HTTP 200 response — it is not limited to the login-failure rendering path used in the original report.

Users are recommended to upgrade to version 24.09.08, which fixes this issue.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_