An unauthenticated file upload vulnerability in Apache OFBiz allows remote attackers to potentially execute arbitrary code, creating a significant risk to system integrity.

This vulnerability is an unrestricted upload of a file with a dangerous type, categorized as CWE-434. The flaw is exploitable by unauthenticated attackers, as indicated by the CVSS vector AV:N/AC:L/PR:N.

The ability for an unauthenticated user to upload arbitrary files to a server poses a critical threat to business operations. Exploitation could lead to remote code execution, unauthorized access to sensitive application data, or total system compromise, resulting in significant reputational and operational damage. While the CVSS score of 7.3 reflects a High severity, the potential for full system takeover necessitates an urgent response.

Immediate Action: Upgrade Apache OFBiz to version 24.09.03 or later immediately to incorporate the necessary file validation and security controls.

Proactive Monitoring: Monitor server logs for unexpected file uploads, unusual file extensions in upload directories, or unauthorized access attempts to the OFBiz application interface.

Compensating Controls: Implement strict Web Application Firewall (WAF) rules to filter incoming requests and block suspicious file upload attempts or access to known vulnerable endpoints.

Public Exploit Available: Yes, a public proof-of-concept exists on GitHub (https://github.com/B1ack4sh/Blackash-CVE-2025-59118).

Given the availability of a public proof-of-concept and the nature of unrestricted file uploads, this vulnerability presents a clear and present danger to affected environments. IT administrators should prioritize the upgrade to version 24.09.03 to eliminate the attack vector entirely. Failure to patch may allow attackers to bypass security boundaries and compromise the underlying server infrastructure.