EUVD-2026-117479

Server-Side Request Forgery in ViewDataFile in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only the base webtools permissions OFBTOOLSVIEW, WEBTOOLSVIEW to cause the server to issue arbitrary outbound HTTP requests, and an attacker additional...