CVE-2024-35219
OpenAPI Generator Online - Arbitrary File Read/Delete
OpenAPI Generator allows generation of API client libraries (SDK generation), server stubs, documentation and configuration automatically given an OpenAPI Spec. Prior to version 7.6.0, attackers can exploit a path traversal vulnerability to read and delete files and folders from an arbitrary, writable directory as anyone can set the output folder when submitting the request via the outputFolder option. The issue was fixed in version 7.6.0 by removing the usage of the outputFolder option. No known workarounds are available.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
OpenAPI Generator Online - Arbitrary File Read/Delete
OpenAPI Generator allows generation of API client libraries (SDK generation), server stubs, documentation and configuration automatically given an OpenAPI Spec. Prior to version 7.6.0, attackers can exploit a path traversal vulnerability to read and delete files and folders from an arbitrary, writable directory as anyone can set the output folder when submitting the request via the outputFolder option. The issue was fixed in version 7.6.0 by removing the usage of the outputFolder option. No known workarounds are available.
- Record
CVE-2024-35219- CVSS 3.1
- 8.3 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H - Weakness
- CWE-22
- Updated
- 2026-11-02
EUVDEUVD-2024-1610
OpenAPI Generator allows generation of API client libraries (SDK generation), server stubs, documentation and configuration automatically given an OpenAPI Spec. Prior to version 7.6.0, attackers can exploit a path traversal vulnerability to read and delete files and folders from an arbitrary, writable directory as anyone can set the output folder when submitting the request via the outputFolder option. The issue was fixed in version 7.6.0 by removing the usage of the outputFolder option. No known workarounds are available.
- Record
EUVD-2024-1610- CVSS 3.1
- 8.3 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-g3hr-p86p-593h
OpenAPI Generator Online - Arbitrary File Read/Delete
Impact
Attackers can exploit the vulnerability to read and delete files and folders from an arbitrary, writable directory as anyone can set the output folder when submitting the request via the outputFolder option.
Patches
The issue was fixed via https://github.com/OpenAPITools/openapi-generator/pull/18652 (included in v7.6.0 release) by removing the usage of the outputFolder option.
Workarounds
No workaround available.
References
No other reference available.
- Record
GHSA-g3hr-p86p-593h- CVSS 3.1
- 8.3 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H - Weakness
- CWE-22
- Updated
- 2026-11-02
NVD
OpenAPI Generator allows generation of API client libraries (SDK generation), server stubs, documentation and configuration automatically given an OpenAPI Spec. Prior to version 7.6.0, attackers can exploit a path traversal vulnerability to read and delete files and folders from an arbitrary, writable directory as anyone can set the output folder when submitting the request via the outputFolder option. The issue was fixed in version 7.6.0 by removing the usage of the outputFolder option. No known workarounds are available.
- Record
CVE-2024-35219- CVSS 3.1
- 8.3 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H - Weakness
- CWE-22
- Updated
- 2026-11-02
OSV
OpenAPI Generator Online - Arbitrary File Read/Delete
OpenAPI Generator allows generation of API client libraries (SDK generation), server stubs, documentation and configuration automatically given an OpenAPI Spec. Prior to version 7.6.0, attackers can exploit a path traversal vulnerability to read and delete files and folders from an arbitrary, writable directory as anyone can set the output folder when submitting the request via the outputFolder option. The issue was fixed in version 7.6.0 by removing the usage of the outputFolder option. No known workarounds are available.
- Record
CVE-2024-35219- CVSS 3.1
- 8.3 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H - Weakness
- CWE-22
- Updated
- 2026-11-02
OSVGHSA-g3hr-p86p-593h
OpenAPI Generator Online - Arbitrary File Read/Delete
Impact
Attackers can exploit the vulnerability to read and delete files and folders from an arbitrary, writable directory as anyone can set the output folder when submitting the request via the outputFolder option.
Patches
The issue was fixed via https://github.com/OpenAPITools/openapi-generator/pull/18652 (included in v7.6.0 release) by removing the usage of the outputFolder option.
Workarounds
No workaround available.
References
No other reference available.
- Record
GHSA-g3hr-p86p-593h- CVSS 3.1
- 8.3 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H - Weakness
- CWE-22
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.openapitools:openapi-generator-onlineMaven |
before 7.6.0 | 7.6.0 |
org.openapitools:openapi-generator-onlineMaven |
before 7.6.0, plus listed versions 3.0.03.0.13.0.23.0.33.1.0 Show 45 moreShow less3.1.13.1.23.2.03.2.13.2.23.2.33.3.03.3.13.3.23.3.33.3.44.0.04.0.0-beta4.0.0-beta24.0.0-beta34.0.14.0.24.0.34.1.04.1.14.1.24.1.34.2.04.2.14.2.24.2.34.3.04.3.15.0.05.0.0-beta5.0.0-beta25.0.0-beta35.0.15.1.05.1.15.2.05.2.15.3.05.3.15.4.06.0.06.0.0-beta6.0.16.1.06.2.0 |
7.6.0 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Nuclei | OpenAPI Generator <= 7.5.0 - Arbitrary File Read/Delete |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, Nuclei, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-35219 is a high vulnerability (CVSS 8.3) in Openapitools Openapi-generator, published May 27, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.59%, the 89th percentile. Fixed in org.openapitools:openapi-generator-online 7.6.0.
References
github.com/OpenAPITools/openapi-generator/security/advisories/GHSA-g3hr-p86p-593h
nvd.nist.gov/vuln/detail/CVE-2024-35219
Left out here: 13 versions. The JSON record has them.