CVE-2026-83542

Name of the Vulnerable Software and Affected Versions Apache OFBiz versions 24.09 through 24.09.07

Description Improper Control of Generation of Code allows a remote unauthenticated attacker to execute arbitrary code on the server. The issue occurs when an attacker stages crafted widget XML via a multipart upload and overrides the mainDecoratorLocation used by a manager login route through an anonymous JSON request. This causes the system to load the staged XML through its live screen descriptor mechanism and evaluate an unsandboxed Groovy expression (a dynamic scripting language for the Java platform) while rendering the authentication-failure page. The flaw is also reachable through the unauthenticated '/sfa/control/editPortalPageColumnWidth' endpoint, which can return command output directly in an HTTP 200 response.

Recommendations Upgrade to version 24.09.08.