What this actually is.
Technical background, root cause, and affected surface.
The Content component of Apache OFBiz before 24.09.06 does not properly restrict pathnames, allowing a low-privileged user to perform local file inclusion and read files outside the intended directory.
- Product
- Apache OFBiz
- Vendor
- Apache
- Severity
- Medium
- CVSS Score
- 6.5
- Status
- Published
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- CWE
- CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
From one request
to root shell.
Reproduced in a sandboxed environment. Requires only LAN or WiFi adjacency.
The bug, and the fix.
Apache OFBiz Content component - file path built from user-controlled input without canonicalisation or restriction to the content directory
What an attacker does to you.
Post-exploitation outcomes mapped to CVSS impact metrics.
Disclosure of local files readable by the OFBiz process (configuration, credentials); limited integrity impact
C:L · I:L · A:N
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Fix it. In this order.
A runbook, not a checklist. Sequence matters — assume compromise before you act.
Upgrade to Apache OFBiz 24.09.06 or later.
disclose@securin.ioVendors moved in days.
Attackers in hours.
Reconstructed from vendor advisories, CISA bulletins, and Securin research records.
Reported to vendor
Fixed release published (24.09.06)
Vendor advisory published
CVE published to MITRE
Disclosed 24 days after discovery
Cite, verify, go deeper.
Primary sources — NVD, CISA KEV, and machine-readable IoC feed.