Apache OFBiz versions prior to 24.09.08 are vulnerable to code injection because the application improperly controls generated code. An attacker can deliver specially crafted widget XML via a multipart upload or exploit the public /sfa/control/editPortalPageColumnWidth route. The system loads the XML through its live screen descriptor mechanism and evaluates an unsandboxed Groovy expression during authentication‑failure rendering, allowing the attacker to execute arbitrary code on the host.

The vulnerability affects the Apache Software Foundation’s Apache OFBiz product, specifically version 24.09 on all supported operating systems. Any deployment that has not yet applied the 24.09.08 security update is at risk.

EPSS data is not available and the vulnerability is not listed in CISA KEV, but the description shows that a remote unauthenticated attacker can exploit the flaw. A well‑formed multipart request or an unauthenticated GET to /sfa/control/editPortalPageColumnWidth triggers the vulnerable code path, enabling arbitrary Groovy code execution. The lack of authentication requirement and the ability to inject and run code indicate a high likelihood of exploitation in exposed environments.