Apache OFBiz up to 24.09.07 ViewFile fileName path traversal

Summaryinfo

A vulnerability labeled as critical has been found in Apache OFBiz up to 24.09.07. The affected element is an unknown function of the component ViewFile. The manipulation of the argument fileName results in path traversal. This vulnerability was named CVE-2026-97356. The attack may be performed from remote. There is no available exploit. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in Apache OFBiz up to 24.09.07. It has been classified as critical. Affected is an unknown part of the component ViewFile. The manipulation of the argument fileName with an unknown input leads to a path traversal vulnerability. CWE is classifying the issue as CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

External Control of File Name or Path vulnerability in the ViewFile component of Label Manager in Apache OFBiz 24.09.07 on all platforms allows an authenticated user holding only the LABEL_MANAGER_VIEW permission to read arbitrary properties and xml files on the server, including the generated JWT signing key, enabling forgery of an authenticated administrator session, via the fileName parameter of a ViewFile request. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

The advisory is shared for download at lists.apache.org. This vulnerability is traded as CVE-2026-97356 since 09/24/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 11/05/2026). The MITRE ATT&CK project declares the attack technique as T1006.

Upgrading to version 24.09.08 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• Apache

Name

• OFBiz

Version

• 24.09.07

License

• open-source

Website

• Vendor: https://www.apache.org/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion