Unauthenticated File Handling Vulnerability in Apache OFBiz
CVE-2026-68524

Currently unrated

Key Information:

Vendor

Apache
Status
Apache Ofbiz
Vendor
CVE Published:
5 November 2026

What is CVE-2026-68524?

An unauthenticated attacker can exploit improper temporary-file handling within Apache OFBiz, leading to unauthorized access. By leveraging an open file descriptor, they can inject a 'file:' URI, causing the system to load a maliciously crafted Screen definition controlled by the attacker. This vulnerability impacts versions of Apache OFBiz prior to 24.09.08. To safeguard your system, users are advised to upgrade to the latest version where this issue has been addressed.

Affected Version(s)

Apache OFBiz 0 < 24.09.08

References

https://lists.apache.org/thread.html/7b2syzksp7klt9fvhdg0...
vendor-advisory

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Naoya Takahashi (nakko)
.