CVSS 7.5 (high) · published 2026-11-05
An unauthenticated attacker can exploit temporary-file handling, access an open file descriptor, and inject a "file:" URI to cause OFBiz to load an attacker-controlled Screen definition. The described vulnerability was discovered independantly twice, with each having a CVE assigned. See References. This issue affects Apache OFBiz: before 24.09.08. Users are recommended to upgrade to version 24.09.08, which fixes the issue.
Weakness: CWE-94
Source: NVD CVE-2026-68524
Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.