Apache OFBiz EUVD-2026-117494

Exploitation requires a network-reachable Apache OFBiz instance running a version before 24.09.08; per the CVSS vector (PR:N/UI:N) it is unauthenticated and needs no user interaction. The concrete prerequisites named in the description are the ability to abuse OFBiz's temporary-file handling, reach an open file descriptor, and inject a 'file:' URI that causes OFBiz to load an attacker-controlled Screen definition. Limiting factors: the specific temporary-file / file-descriptor code path must be reachable in the deployment, and instances already on 24.09.08 or later are not affected; the available sources do not describe further configuration preconditions, so whether non-default settings are required is unverified.

Signals point to a credible but non-emergency priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw, which is the worst-case exposure profile and drives the 7.5 base score - but note that score is carried entirely by confidentiality (C:H/I:N/A:N), with no integrity or availability impact recorded. That official scoring conflicts with the 'RCE' tag and the CWE-94 (code injection) classification: loading an attacker-controlled Screen definition in OFBiz is a code-injection primitive, yet NVD scored only information disclosure, so the true impact ceiling is ambiguous and should be verified against the vendor advisory. Threat-intel signals are cool: EPSS is 0.22% (12th percentile), there is no CISA KEV listing, and no public exploit is identified at time of analysis, so there is no evidence of active or widespread exploitation. The vuln.today decision label is 'this_week' - meaningful urgency but not act_now/emergency. Net: a genuinely exploitable unauthenticated network flaw in a patched product that warrants scheduled remediation this week, not a drop-everything response, with the caveat that the confidentiality-only CVSS may understate a code-injection impact.

An unauthenticated remote attacker sends a crafted request that abuses OFBiz's temporary-file handling to reach an open file descriptor, then injects a 'file:' URI so OFBiz loads a Screen definition the attacker controls (CWE-94 code injection). Because the vector is AV:N/AC:L/PR:N/UI:N, no credentials or user interaction are needed against a vulnerable, network-reachable instance. No public exploit code is identified at time of analysis.