{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-97356","assignerOrgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","state":"PUBLISHED","assignerShortName":"apache","dateReserved":"2026-09-24T13:20:41.141Z","datePublished":"2026-11-05T13:44:53.126Z","dateUpdated":"2026-11-05T13:44:53.126Z"},"containers":{"cna":{"providerMetadata":{"orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","shortName":"apache","dateUpdated":"2026-11-05T13:44:53.126Z"},"title":"Apache OFBiz: Insufficiently Protected Credentials in ViewFile Enable Authentication Bypass","problemTypes":[{"descriptions":[{"description":"CWE-73 External control of file name or path","lang":"en","cweId":"CWE-73","type":"CWE"}]}],"source":{"discovery":"EXTERNAL"},"affected":[{"vendor":"Apache Software Foundation","product":"Apache OFBiz","versions":[{"status":"affected","version":"0","lessThan":"24.09.08","versionType":"semver"}],"defaultStatus":"unaffected"}],"descriptions":[{"value":"External Control of File Name or Path vulnerability in the ViewFile component of Label Manager in Apache OFBiz 24.09.07 on all platforms allows an authenticated user holding only the LABEL_MANAGER_VIEW permission to read arbitrary properties and xml files on the server, including the generated JWT signing key, enabling forgery of an authenticated administrator session, via the fileName parameter of a ViewFile request.\nUsers are recommended to upgrade to version 24.09.08, which fixes this issue.","lang":"en","supportingMedia":[{"type":"text/html","base64":false,"value":"External Control of File Name or Path vulnerability in the ViewFile component of Label Manager in Apache OFBiz 24.09.07 on all platforms allows an authenticated user holding only the LABEL_MANAGER_VIEW permission to read arbitrary properties and xml files on the server, including the generated JWT signing key, enabling forgery of an authenticated administrator session, via the fileName parameter of a ViewFile request.<br>Users are recommended to upgrade to version 24.09.08, which fixes this issue."}]}],"references":[{"url":"https://lists.apache.org/thread.html/7b2syzksp7klt9fvhdg0olldvs2g83lz","tags":["vendor-advisory"]}],"metrics":[{"other":{"type":"Textual description of severity","content":{"text":"important"}},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"credits":[{"lang":"en","value":"Gaosong Zhang (zhanggaosong@fudan.edu.cn)","type":"reporter"},{"lang":"en","value":"Zeo666666","type":"reporter"}],"x_generator":{"engine":"Vulnogram 1.0.3"}}}}