Code Injection Vulnerability in Apache OFBiz by Apache

CVE-2026-83542

What is CVE-2026-83542?

A code injection vulnerability found in Apache OFBiz 24.09 prior to version 24.09.08 allows remote unauthenticated attackers to execute arbitrary code on the server. This is achieved through the manipulation of widget XML in a multipart upload, enabling an attacker to override the mainDecoratorLocation used in manager login routes via anonymous JSON requests. As a consequence, OFBiz processes the injected XML through its live screen descriptor mechanism, executing an unsandboxed Groovy expression during the rendering of the authentication failure page. It is notable that this exploit does not depend on malformed multipart bodies, as even well-formed requests can be exploited. Additionally, the vulnerability can be accessed via the publicly unauthenticated /sfa/control/editPortalPageColumnWidth route, returning command output directly in the HTTP response. Users are strongly advised to upgrade to version 24.09.08 to mitigate this risk.

References