Unrated severityNVD Advisory· Published Nov 5, 2026
CVE-2026-68524
CVE-2026-68524
Description
An unauthenticated attacker can exploit temporary-file handling, access an open file descriptor, and inject a "file:" URI to cause OFBiz to load an attacker-controlled Screen definition.
This issue affects Apache OFBiz: before 24.09.08.
Users are recommended to upgrade to version 24.09.08, which fixes the issue.
Affected products
1Patches
Vulnerability mechanics
References
1News mentions
1- ThreatsDay: Apache OFBiz RCE, DreamHost Breach, DeFi Site Hijacks + 17 More StoriesThe Hacker News · Nov 5, 2026