Apache OFBiz Path Traversal Vulnerability

CRITICAL 9.8EXPLOITED (CISA KEV)CVE-2024-32113 · Published 08/05/2024 · updated 17/06/2026

Apache OFBiz Path Traversal Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 07/08/2024. Patch affected systems as an emergency.

Package	Affected versions	Patched versions
ofbiz apache	`< 18.12.13`	`18.12.13`

Description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz.This issue affects Apache OFBiz: before 18.12.13. Users are recommended to upgrade to version 18.12.13, which fixes the issue.

References

openwall.com/lists/oss-security/2024/05/09/1 · Mailing List
issues.apache.org/jira/browse/OFBIZ-13006 · Vendor Advisory
lists.apache.org/thread/w6s60okgkxp2th1sr8vx0ndmgk68fqrd · Mailing List
ofbiz.apache.org/download.html · Product
ofbiz.apache.org/security.html · Patch
cisa.gov/known-exploited-vulnerabilities-catalog · Third Party Advisory
CISA KEV · CVE-2024-32113

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free