Low Severity
CVE-2026-83542
Published: Nov 12, 2026
Detection-only local triage for Apache OFBiz CVE-2026-83542 (CVSS 9.8) and the 24.09.08 batch — grades installs against the fixed release. No probing, no payloads.
# `ofbiz-scanner`
Local triage for the `Apache OFBiz 24.09.08` batch, headlined by `CVE-2026-83542` (`CVSS 9.8`), an unauthenticated remote code execution flaw. Give it an `OFBiz` version you own, or point it at an install directory, and it tells you whether that install is still open. It never touches the network, never probes a server, never sends a crafted request.
## `The flaw`
`CVE-2026-83542` is improper control of code generation (`CWE-94`) in `Apache OFBiz` before `24.09.08`, on all platforms. An unauthenticated attacker stages crafted widget `XML` in a multipart upload, then overrides the `mainDecoratorLocation` used by a manager login route through an anonymous `JSON` request. `OFBiz` loads the staged `XML` through its live screen descriptor mechanism and evaluates an unsandboxed `Groovy` expression while rendering the authentication-failure page. The exploit does not need a malformed multipart body: a well-formed upload kept in flight and then allowed to complete normally is enough, and the screen loader reads the widget `XML` from a live process file descriptor while the upload is still streaming, not from any file the attacker persists to disk. The same underlying issue is also reachable through the public, explicitly unauthenticated `/sfa/control/editPortalPageColumnWidth` route, which returns command output directly in an `HTTP 200` response. It is not limited to the login-failure rendering path from the original report.
The `24.09.08` release fixes `46 CVEs` in one batch. The ones that need no login at all:
| `CVE` | `Score` | `Type` | `What it does` |
| --- | --- | --- | --- |
| `CVE-2026-83542` | `9.8` | `CWE-94` | Unauthenticated `RCE` via login-page widget injection |
| `CVE-2026-68524` | Awaiting analysis | `CWE-94` | Pre-authentication `RCE` via attacker-controlled screen definition loading |
| `CVE-2026-73578` | Awaiting analysis | `CWE-288` | Unauthenticated saved-view authorization bypass with `RCE` impact |
| `CVE-2026-105330` | Awaiti