PT-2025-46557 · Apache · Apache Ofbiz

Published 2025-11-11 · Updated 2025-12-23 · CVE-2025-59118

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Apache OFBiz versions prior to 24.09.03

Description A critical unrestricted file upload issue exists in Apache OFBiz. This allows remote attackers to upload arbitrary files, potentially including malicious scripts, leading to remote command execution (RCE) on the server. Successful exploitation could result in full system compromise, web shell deployment, or lateral movement within connected networks. Approximately 1.2k to 1.6k services are estimated to be affected worldwide. The issue involves the ability to upload dangerous file types without proper restrictions.

Recommendations Upgrade to version 24.09.03 to resolve the issue.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-59118

Affected Products

Apache Ofbiz

References · 20

• https://lists.apache.org/thread/202263kpy7g76pzsy1fm96h9lcmhsqpt · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-59118 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-59118 · Security Note
• https://ofbiz.apache.org/download.html · Note
• https://twitter.com/fofabot/status/1988563286028386612 · Twitter Post
• https://twitter.com/akaclandestine/status/1989257088808136756 · Twitter Post
• https://twitter.com/Karma_X_Inc/status/1988476418842395058 · Twitter Post
• https://twitter.com/akaclandestine/status/1989761405462175994 · Twitter Post
• https://twitter.com/HunterMapping/status/1988806566766637556 · Twitter Post
• https://twitter.com/Komodosec/status/2002046909230546947 · Twitter Post
• https://t.me/pentestingnews/70822 · Telegram Post
• http://openwall.com/lists/oss-security/2025/11/11/1 · Note
• https://issues.apache.org/jira/browse/OFBIZ-13292 · Note
• https://twitter.com/oss_security/status/1988365614247788825 · Twitter Post
• https://twitter.com/zoomeye_team/status/1988811636275310784 · Twitter Post