CVE-2024-36104: Apache OFBiz path traversal allows unauthenticated file access

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

critical priorityCVSS 9.1 critical with network, unauthenticated, no-interaction access and a very high EPSS probability, though not in KEV and with no documented exploit reference.

What it is

Apache OFBiz before 18.12.14 fails to properly restrict pathnames to a restricted directory, allowing path traversal (CWE-22). Because the flaw is remotely reachable without authentication, it exposes the application to direct file access and manipulation. The vendor recommends upgrading to 18.12.14, which fixes the issue.

Impact

An unauthenticated attacker can read and write files outside the intended directory, with high confidentiality and integrity impact. Availability is not affected per the CVSS vector.

Attack surface

Reachable over the network via HTTP with no authentication and no user interaction required (AV:N/AC:L/PR:N/UI:N). The record does not specify the exact endpoint or parameter, so the precise request path is unknown.

Exploitation

Not listed in CISA KEV and no ransomware usage is documented, but EPSS is very high (0.878, 99.75th percentile), indicating elevated likelihood of exploitation. Reference tags are only mailing list, issue tracking, release notes, product and vendor advisory; no public exploit reference is provided.

What to do

• Upgrade Apache OFBiz to 18.12.14 or later, which the vendor states fixes the issue.
• If immediate upgrade is not possible, restrict network access to OFBiz instances to trusted networks and place them behind an authenticating reverse proxy.
• Run OFBiz with least privilege so a traversal cannot reach sensitive files or write to critical directories.
• Monitor the vendor security page and OFBIZ-13092 for further guidance or backports.

Detection

• Inspect web and proxy logs for requests containing traversal sequences such as ../ or encoded variants (..%2f, %2e%2e/) targeting OFBiz paths.
• Alert on file access or modification events outside expected OFBiz directories, especially reads of configuration or credential files.
• Baseline normal OFBiz request patterns and flag anomalous file-path parameters or unusual URL encoding.
• Correlate outbound or file-system activity from the OFBiz process with unexpected paths for signs of post-exploitation.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.