CVE-2026-82902

Server-Side Request Forgery in ViewDataFile in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only the base webtools permissions OFBTOOLSVIEW, WEBTOOLSVIEW to cause the server to issue arbitrary outbound HTTP requests, and an attacker additional...

CVE-2026-82902

Apache OFBiz versions 24.09 before 24.09.08 are vulnerable to Server-Side Request Forgery (SSRF) in the ViewDataFile component. The root cause is that ViewDataFile.groovy dereferences the DEFINITION_LOCATION or DATAFILE_LOCATION parameters as java.net.URL objects without implementing a scheme all...

CVE-2026-82902 Apache OFBiz: Unfiltered server-side URL fetch in webtools viewdatafile

Server-Side Request Forgery in ViewDataFile in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only the base webtools permissions OFBTOOLSVIEW, WEBTOOLSVIEW to cause the server to issue arbitrary outbound HTTP requests, and an attacker additional...