CVE-2026-82916: Apache OFBiz: webtools xmldsdump exports any entity to any path
Missing Authorization in XmlDsDump in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only the webtools base permissions (OFBTOOLSVIEW, WEBTOOLSVIEW) — explicitly not the ENTITYMAINT permission the export feature declares and visibly refuses to render for — to export the contents of any database entity, including UserLogin with its currentPassword hashes, to any filesystem path the OFBiz process can write, including a web-served docroot, and to create arbitrary directories or truncate arbitrary existing files at those paths, because the XmlDsDump screen action writes the requested entity data via new FileOutputStream on unvalidated outpath and filename request parameters before the screen's ENTITYMAINT permission check runs, unlike the equivalent Java service entityExportAll, which enforces both a permission check and a file-path allow-list. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache OFBizto a version that resolves this vulnerability.Fixed in 24.09.08
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Apache OFBiz deployments running 24.09 releases before 24.09.08 are affected. An attacker must be remotely authenticated with the OFBTOOLS_VIEW and WEBTOOLS_VIEW webtools base permissions; ENTITY_MAINT is not required.
What can an attacker do with this access?
They can export any database entity, including UserLogin records containing currentPassword hashes, to any path writable by the OFBiz process. They can also create directories and truncate existing files at writable target paths, including web-served document roots.
Are default permission checks sufficient protection?
No. Although the export feature declares and visibly enforces ENTITY_MAINT in the screen, file writing occurs before that check, allowing users with only the webtools base permissions to exploit the issue.
What should be done if patching cannot happen immediately?
Restrict OFBTOOLS_VIEW and WEBTOOLS_VIEW permissions to trusted users and reduce the filesystem locations writable by the OFBiz process, particularly web-served document roots. Upgrade to 24.09.08 when possible.
How can defenders look for possible exploitation?
Review filesystem locations writable by the OFBiz process for unexpected exported entity data, newly created directories, or unexpectedly truncated files. Pay particular attention to web-served document roots and files containing database entity exports such as UserLogin data.