CVE-2026-97356

A flaw was found in Apache OFBiz. An authenticated user with basic view permissions can read arbitrary configuration and XML files on the server by supplying a manipulated file name in a ViewFile request. An attacker can exploit this issue to retrieve the JSON Web Token JWT signing key, enabling...