Apache OFBiz Logo

Downloads

Download Apache OFBiz

image fullwidth

Use the links below to download Apache OFBiz releases from the "Apache Download Mirrors" page. The download page also includes instructions on how to verify the integrity of the release file using the signature and hash (PGP, SHA512) available for each release. If you need more information about why and how to verify the integrity of the release file this → page is what you look for

Then, to install OFBiz, follow the explanations in the "INSTALL" file found in the just downloaded/extracted OFBiz main directory.

PLEASE NOTE: Despite our best efforts to maintain up to three active release branches, support for older branches can decrease because our project volunteers may be focused on other issues. We recommend using releases from the most recent branch wherever possible.

NOTE: To minimize the risk of security vulnerabilities the Apache OFBiz community highly recommends that all users upgrade to the latest stable release.

The history of security related fixes included in each release is available here

Apache OFBiz 24.09.01

Released in April 2025, this is the first release of the 24.09 series, which has been feature-frozen since September 2024, receiving only bug fixes.

Download OFBiz 24.09.01 [PGP] [SHA512] [KEYS] [Release Notes]

We strongly encourage OfBiz users to report security problems affecting OFBiz to the private security mailing lists (either security@ofbiz.apache.org or security@apache.org), before disclosing them in a public forum. Please don't pack several vulnerabilities in the same report, send them one by one, thanks in advance.

Note that we no longer create CVEs for post-auth attacks done using demo credentials, notably using the admin user. Rather create bugs reports in our issue tracker (Jira) for that. Please don't create Jira issues for unauth (aka pre-auth) reports, thanks in advance.

One of the reason we no longer create CVEs for post-auth attacks done using demo credentials is because we highly suggest to OFBiz users to not use credentials demo in production and we expect OFBiz users to do so. We also warn our users on the "Keeping OFBiz secure wiki page". And finally, mostly we reject post-auth vulnerabilities because we have a solid CSRF defense.

Earlier Releases

Older superseded releases of Apache OFBiz can be found in the Apache OFBiz archive

A description of each release in the history of OFBiz can be found here