Vulnerabilities

Server-Side Request Forgery in ViewDataFile in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding…

Server-Side Request Forgery in ViewDataFile in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only the base webtools permissions (OFBTOOLS_VIEW, WEBTOOLS_VIEW) to cause the server to issue arbitrary outbound HTTP requests, and an attacker additionally holding ENTITY_MAINT and DATAFILE_MAINT to read arbitrary local files via a file: URL, by supplying the DEFINITION_LOCATION or DATAFILE_LOCATION request parameter to the viewdatafile screen, because ViewDataFile.groovy dereferences both parameters as java.net.URL objects with no scheme allow-list, host filter, or egress control inside a screen action that runs before the screen's and template'

Read at NIST National Vulnerability Database (CVE API 2.0)

Vendor

Apache Software Foundation

Product

Apache OFBiz

Fix

available

Weakness

CWE-862, CWE-918

Exposure class

Web platform

NVD status

Awaiting Analysis

• NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
• CVE-2026-82902 on this site · NVD · CVE.org · Vulnpedia

Other items that share a CVE or were clustered with this one.

1. 25
   CVE NVD 1h ago

   Missing Authorization in XmlDsDump in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only the…

   Fix available CVE-2026-82916 Apache Software Foundation