CVE-2026-31379 - Apache OFBiz: Path Traversal and File Upload Validation Bypass Leading to Arbitrary File Write, Stored XSS and RCE in Catalog Manager

Back Back to CVE browser

MEDIUM

Apache OFBiz: Path Traversal and File Upload Validation Bypass Leading to Arbitrary File Write, Stored XSS and RCE in Catalog Manager

Published May 19, 2026

6.1

MEDIUM

CVSS 3.1

EPSS 0.70%

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz.

This issue affects Apache OFBiz: before 24.09.06.

Users are recommended to upgrade to version 24.09.06, which fixes the issue.

Affected products

Vendor Apache Software Foundation Product Apache OFBiz Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <24.09.06

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Apache Software Foundation

Apache OFBiz

unaffected

Version	Status	Constraints
0	affected	<24.09.06

Remediation

No remediation recorded yet.

Weaknesses (3)

CWE-22

Path Traversal

CWE-79

Cross-site Scripting (XSS)

CWE-94

Code Injection

References (3)

http://www.openwall.com/lists/oss-security/2026/05/19/18
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-30860
Advisory
https://lists.apache.org/thread/1tcnkxjm0s6n1ohfb21brl25dt0hv9by
vendor-advisoryMailing ListVendor Advisory

Link	Providers	Tags
http://www.openwall.com/lists/oss-security/2026/05/19/18
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-30860		Advisory
https://lists.apache.org/thread/1tcnkxjm0s6n1ohfb21brl25dt0hv9by		vendor-advisoryMailing ListVendor Advisory