Apache OFBiz EUVD-2026-117470

No special conditions beyond running an affected build - remote unauthenticated exploitation against default configurations of Apache OFBiz 24.09 prior to 24.09.08. The attack requires only a well-formed multipart upload held in flight (no malformed/incomplete body needed) plus an anonymous JSON request to override mainDecoratorLocation; the widget XML is read from the live process file descriptor while streaming, so the attacker need not persist any file to disk. The description further establishes the flaw is reachable via the public, explicitly unauthenticated /sfa/control/editPortalPageColumnWidth route, so it is not limited to the login-failure rendering path. The only real limiting factor is version: deployments on 24.09.08 or outside the 24.09 branch range are not stated to be affected.

All severity signals align toward high priority. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) describes remote, unauthenticated, low-complexity code execution with full confidentiality/integrity/availability impact, and the vuln.today decision label is act_now - so urgent remediation is indicated. The description reinforces rather than contradicts the vector: it documents a public, explicitly unauthenticated route (/sfa/control/editPortalPageColumnWidth) that returns command output directly in an HTTP 200 response, confirming the network/no-privilege metrics are realistic rather than theoretical. Two signals are MISSING from the input and should be noted explicitly: no EPSS exploitation-probability score is provided, and there is no CISA KEV entry, so active in-the-wild exploitation is NOT confirmed. No field in the input states 'POC: Publicly available (confirmed)'; the references are vendor/mailing-list advisories (a detailed oss-security technical write-up), not verified working exploit code. Net assessment: this is a genuine high-priority RCE on its merits (unauthenticated network RCE with a vendor fix available and an act_now label), not a high-CVSS-but-low-real-risk case, but the real-world exploitation rate cannot be quantified because EPSS and KEV data are absent.

A remote, unauthenticated attacker sends a well-formed multipart upload containing crafted widget XML and keeps the connection in flight, then issues an anonymous JSON request that overrides mainDecoratorLocation so OFBiz loads the staged XML from the live upload file descriptor and evaluates an unsandboxed Groovy expression, yielding code execution on the server. Validation shows the same flaw is reachable through the public /sfa/control/editPortalPageColumnWidth route, which returns command output directly in an HTTP 200 response. No verified public exploit code is listed in the input, but a detailed technical advisory describing the chain exists on oss-security.