CVE-2026-97356 in OFBiz
Summary
by MITRE • 11/05/2026
External Control of File Name or Path vulnerability in the ViewFile component of Label Manager in Apache OFBiz 24.09.07 on all platforms allows an authenticated user holding only the LABEL_MANAGER_VIEW permission to read arbitrary properties and xml files on the server, including the generated JWT signing key, enabling forgery of an authenticated administrator session, via the fileName parameter of a ViewFile request. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 11/05/2026
The vulnerability identified in Apache OFBiz versions prior to 24.09.08 represents a critical security flaw within the Label Manager component, specifically affecting the ViewFile functionality. This issue is classified as an External Control of File Name or Path vulnerability, which aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory. The core technical failure lies in the insufficient validation and sanitization of user-supplied input passed via the fileName parameter during file viewing operations. Although access to this component is restricted by default to users possessing only the LABEL_MANAGER_VIEW permission, which should theoretically limit exposure to label-related resources, the implementation fails to enforce strict path constraints. This allows an authenticated attacker with minimal privileges to manipulate the file path argument to traverse outside the intended directory structure and access arbitrary files on the underlying server operating system.
The operational impact of this vulnerability is severe due to its potential for privilege escalation through credential forgery. By exploiting the unrestricted file read capability, an attacker can retrieve sensitive configuration files stored on the server. Most critically, this includes the JSON Web Token signing key used by OFBiz to authenticate and authorize user sessions. The exposure of this cryptographic secret allows the attacker to forge valid JWTs with arbitrary claims, including administrative roles that were not originally granted to their account. This effectively bypasses authentication controls entirely for subsequent requests, granting the attacker full administrator access to the application without needing additional credentials or exploiting further vulnerabilities in the login mechanism.
From a threat modeling perspective, this vulnerability facilitates unauthorized data disclosure and subsequent privilege escalation, mapping directly to ATT&CK techniques such as T1078: Valid Accounts and potentially T1528: Steal Application Access Token if viewed through the lens of token manipulation. The ability to read arbitrary files also opens avenues for further reconnaissance, allowing attackers to map out server architecture, locate other sensitive data stores, or identify additional vectors for exploitation based on file contents. This scenario highlights a common pitfall in web application development where permission checks are applied at the functional level but not rigorously enforced at the input validation layer regarding resource access paths.
To mitigate this risk, organizations running Apache OFBiz must immediately upgrade to version 24.09.08 or later, which contains the necessary code fixes to properly restrict file path inputs and prevent directory traversal attacks. In environments where upgrading is not immediately feasible, temporary mitigations should include implementing strict input validation on the fileName parameter at a reverse proxy or web application firewall level to block attempts containing relative path sequences such as dot-dot-slash. Additionally, ensuring that the LABEL_MANAGER_VIEW permission does not grant access to sensitive system configuration directories can reduce the blast radius if similar vulnerabilities exist elsewhere in the codebase. Regular auditing of file access controls and adherence to the principle of least privilege are essential practices to prevent exploitation of external control flaws in enterprise applications.