Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.14. Users are recommended to upgrade to version 18.12.14, which fixes the issue.
CVE-2024-36104
CVSS base score
9.1 (v3.1)
Severity
CRITICAL
Attack vector
Network
Weakness
CWE-22
Last modified
November 3, 2026
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected products
apache ofbiz
References
- www.openwall.com Mailing List
- issues.apache.org Issue Tracking
- lists.apache.org Mailing List, Release Notes
- ofbiz.apache.org Product
- ofbiz.apache.org Vendor Advisory
- www.openwall.com Mailing List
- issues.apache.org Issue Tracking
- lists.apache.org Mailing List, Release Notes
- ofbiz.apache.org Product
- ofbiz.apache.org Vendor Advisory