External Control of File Name or Path Vulnerability in Apache OFBiz by Apache
CVE-2026-97356

Currently unrated

Key Information:

Vendor

Apache
Status
Apache Ofbiz
Vendor
CVE Published:
5 November 2026

What is CVE-2026-97356?

An external control of file name or path vulnerability exists in the ViewFile component of Label Manager in Apache OFBiz 24.09.07. This flaw allows authenticated users with the LABEL_MANAGER_VIEW permission to access arbitrary properties and XML files stored on the server. This includes sensitive files, such as the generated JWT signing key, which can lead to the forgery of an authenticated administrator session. It is strongly advised that users upgrade to version 24.09.08 to mitigate this risk.

Affected Version(s)

Apache OFBiz 0 < 24.09.08

References

https://lists.apache.org/thread.html/7b2syzksp7klt9fvhdg0...
vendor-advisory

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Gaosong Zhang (zhanggaosong@fudan.edu.cn)
Zeo666666
.