AI analysis
Claude Opus · 8 Nov 2026, 10:21 CET
Apache OFBiz code injection allows unauthenticated remote code execution
A critical code injection flaw in Apache OFBiz 24.09 before 24.09.08 lets a remote, unauthenticated attacker run arbitrary code on the server. Upgrade to 24.09.08 immediately.
In plain terms
Apache OFBiz is an open-source enterprise resource planning (ERP) suite used to run business functions such as accounting, inventory and e-commerce. This vulnerability lets an attacker who has no account and only needs network access to the application trick OFBiz into running code the attacker supplies, effectively taking control of the server.
Anyone operating Apache OFBiz version 24.09 before 24.09.08 should treat this as urgent. Because no login or user interaction is required, an internet-facing OFBiz instance is directly at risk of full compromise.
Technical analysis
The flaw is classified as CWE-94, improper control of code generation (code injection). According to the record, an attacker stages crafted widget XML inside a multipart upload and overrides the mainDecoratorLocation used by a manager login route through an anonymous JSON request. OFBiz then loads the staged XML through its live screen descriptor mechanism and evaluates an unsandboxed Groovy expression while rendering the authentication-failure page.