CVE-2026-68524

CVE-2026-68524CVE-2026-68524

Description

An unauthenticated attacker can exploit temporary-file handling, access an open file descriptor, and inject a "file:" URI to cause OFBiz to load an attacker-controlled Screen definition. This issue affects Apache OFBiz: before 24.09.08. Users are recommended to upgrade to version 24.09.08, which fixes the issue.

Scoring

Last modified2026-11-05
Sourced from NVD. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.