← Back to search

CVE-2026-83542

9.8 CRITICAL

Published 2026-11-05 · Updated 2026-11-06

AI risk analysis

Summary
A code injection flaw in Apache OFBiz 24.09 before 24.09.08 allows unauthenticated remote attackers to execute arbitrary Groovy code by uploading malicious widget XML that overrides the mainDecoratorLocation, which is then evaluated unsandboxed during authentication failure rendering or other screen descriptor loads.
Exploitability
Exploitation is straightforward for a remote unauthenticated attacker; no authentication, user interaction, or special conditions are required beyond sending a single multipart request.
Blast radius
Successful exploitation grants full server compromise (CIA impact), enabling complete data theft, system modification, and persistence.
Detection
Defenders should monitor for multipart HTTP POST requests to endpoints like /sfa/control/editPortalPageColumnWidth or login routes that include unusually large or suspiciously structured XML content in the upload, especially if followed by HTTP 200 responses containing Groovy output or unexpected screen rendering artifacts. No reliable host or network indicator is derivable from the published description.
Prioritized remediation
Upgrade to Apache OFBiz version 24.09.08 immediately.
rcecode-injectionunauthenticatedwebappgroovy

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

Improper Control of Generation of Code ('Code Injection') in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to execute arbitrary code on the server by staging crafted widget XML in a multipart upload and overriding the mainDecoratorLocation used by a manager login route through an anonymous JSON request, causing OFBiz to load the staged XML through its live screen descriptor mechanism and evaluate an unsandboxed Groovy expression while rendering the authentication-failure page. Further validation established the following: -- The exploit does not require a malformed or incomplete multipart body: a well-formed multipart request that is kept in flight and then allowed to complete normally is sufficient. -- The screen loader reads the widget XML from a live process file descriptor while the upload is streaming, rather than from any file the attacker persists to disk. -- The same underlying issue is also reachable through the public, explicitly unauthenticated /sfa/control/editPortalPageColumnWidth route, returning command output directly in an HTTP 200 response — it is not limited to the login-failure rendering path used in the original report. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-94

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.