CVE-2026-31379

Vulnerability

The vulnerability exists in Apache OFBiz's Catalog Manager component, involving improper limitation of a pathname to a restricted directory (path traversal) and improper control of generation of code (code injection) [1]. An attacker can bypass file upload validation to write arbitrary files to the server, leading to stored cross-site scripting or remote code execution. Affected versions are Apache OFBiz before 24.09.06 [1].

Exploitation

To exploit, an attacker must be authenticated with access to the Catalog Manager. They can upload a malicious file (e.g., a JSP) with a crafted path, traversing out of the intended upload directory to overwrite critical files [1]. No user interaction is required beyond the upload action.

Impact

Successful exploitation allows arbitrary file write, potentially leading to remote code execution, stored XSS, and information disclosure. The attacker gains the privileges of the OFBiz application [1].

Mitigation

Upgrade to Apache OFBiz version 24.09.06, released on 2026-05-19 [1]. No workaround is available; users should apply the patch immediately.