An unauthenticated attacker can exploit temporary-file handling and an open file descriptor in Apache OFBiz to inject a "file:" URI that causes the platform to load an attacker‑controlled Screen definition. Because Screen definitions are executed within the OFBiz runtime, this vulnerability allows arbitrary code execution, undermining system confidentiality and integrity.

Apache Software Foundation’s Apache OFBiz, any release prior to version 24.09.08 is affected. The issue applies to all deployments of these older versions regardless of custom configuration. Upgrading to 24.09.08 or later removes the flaw.

The vulnerability is pre‑authentication and requires no privileged access, making it trivially exploitable if the application is reachable. No EPSS score is available and the issue is not listed in CISA KEV, but the inherent nature of remote code execution and the lack of obvious mitigation steps mean the risk is high. Attackers only need to trigger a Screen definition load using a crafted "file:" URI to succeed.