Skip to content
OpenAdvisories
High · 7.5 Public exploit CVE-2026-68524 EUVD-2026-117494GHSA-jcx6-8pcq-frpq

Apache OFBiz: Pre-Authentication Remote Code Execution via Attacker-Controlled Screen Definition Loading

Published Nov 5, 2026 · Updated Nov 12, 2026 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache OFBiz

Description

An unauthenticated attacker can exploit temporary-file handling, access an open file descriptor, and inject a "file:" URI to cause OFBiz to load an attacker-controlled Screen definition.

The described vulnerability was discovered independantly twice, with each having a CVE assigned. See References.

This issue affects Apache OFBiz: before 24.09.08.

Users are recommended to upgrade to version 24.09.08, which fixes the issue.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache OFBiz < 24.09.08 24.09.08

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • fixedbyreboot/CVE-2026-68524-POC ★ 0 · Nov 10, 2026

    POC exploit for CVE-2026-68524 - preauth RCE in Apache OFBiz via request body shadowing the decorator location and file URI screen loading. Verified on 24.09.07, control on 24.09.08.

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 1

References