CVE-2026-82902

Name of the Vulnerable Software and Affected Versions Apache OFBiz versions 24.09 through 24.09.07

Description An issue exists in the ViewDataFile component where a remote authenticated attacker with base webtools permissions (OFBTOOLS VIEW, WEBTOOLS VIEW) can force the server to issue arbitrary outbound HTTP requests. Attackers who also possess ENTITY MAINT and DATAFILE MAINT permissions can read arbitrary local files using a file: URL. This occurs because the ViewDataFile.groovy file dereferences the DEFINITION LOCATION and DATAFILE LOCATION request parameters as java.net.URL objects without a scheme allow-list, host filter, or egress control. The execution happens within a screen action that runs before permission checks for the screen and template are evaluated, allowing the fetch to execute regardless of the user's authorization to view the result.

Recommendations Upgrade to version 24.09.08.