CVE-2026-82916

Name of the Vulnerable Software and Affected Versions Apache OFBiz versions 24.09 through 24.09.07

Description An authorization flaw in the XmlDsDump screen action allows a remote authenticated attacker with basic webtools permissions (OFBTOOLS VIEW, WEBTOOLS VIEW) to export the contents of any database entity, such as UserLogin containing currentPassword hashes. This occurs because the action uses FileOutputStream to write data based on unvalidated outpath and filename request parameters before the required ENTITY MAINT permission check is performed. This can lead to the creation of arbitrary directories, the truncation of existing files, or the writing of sensitive data to web-served directories.

Recommendations Upgrade to version 24.09.08.