{"id":"CVE-2026-97356","aliases":["EUVD-2026-117462","GHSA-p226-qvp6-xgcg"],"status":"published","title":"Apache OFBiz: Insufficiently Protected Credentials in ViewFile Enable Authentication Bypass","description":"External Control of File Name or Path vulnerability in the ViewFile component of Label Manager in Apache OFBiz 24.09.07 on all platforms allows an authenticated user holding only the LABEL_MANAGER_VIEW permission to read arbitrary properties and xml files on the server, including the generated JWT signing key, enabling forgery of an authenticated administrator session, via the fileName parameter of a ViewFile request.\nUsers are recommended to upgrade to version 24.09.08, which fixes this issue.","epss":{"day":"2026-11-09","score":0.0019,"percentile":0.0871,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-73"],"published":"2026-11-05T13:44:53Z","modified":"2026-11-05T15:34:15Z","products":[{"vendor":"apache software foundation","product":"apache ofbiz"}],"references":[{"url":"https://lists.apache.org/thread.html/7b2syzksp7klt9fvhdg0olldvs2g83lz","tags":["vendor-advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97356"},{"url":"https://github.com/advisories/GHSA-p226-qvp6-xgcg"}],"sources":{"cve":[{"id":"CVE-2026-97356","title":"Apache OFBiz: Insufficiently Protected Credentials in ViewFile Enable Authentication Bypass","description":"External Control of File Name or Path vulnerability in the ViewFile component of Label Manager in Apache OFBiz 24.09.07 on all platforms allows an authenticated user holding only the LABEL_MANAGER_VIEW permission to read arbitrary properties and xml files on the server, including the generated JWT signing key, enabling forgery of an authenticated administrator session, via the fileName parameter of a ViewFile request.\nUsers are recommended to upgrade to version 24.09.08, which fixes this issue.","status":"published","published":"2026-11-05T13:44:53.126Z","modified":"2026-11-05T13:44:53.126Z","cwes":["CWE-73"],"updated_at":"2026-11-05T16:36:34.343037Z"}],"euvd":[{"id":"EUVD-2026-117462","description":"External Control of File Name or Path vulnerability in the ViewFile component of Label Manager in Apache OFBiz 24.09.07 on all platforms allows an authenticated user holding only the LABEL_MANAGER_VIEW permission to read arbitrary properties and xml files on the server, including the generated JWT signing key, enabling forgery of an authenticated administrator session, via the fileName parameter of a ViewFile request.\nUsers are recommended to upgrade to version 24.09.08, which fixes this issue.","status":"published","published":"2026-11-05T13:44:53Z","modified":"2026-11-05T13:44:53Z","updated_at":"2026-11-05T18:01:00.39688Z"}],"ghsa":[{"id":"GHSA-p226-qvp6-xgcg","title":"External Control of File Name or Path vulnerability in the ViewFile component of Label Manager in...","description":"External Control of File Name or Path vulnerability in the ViewFile component of Label Manager in Apache OFBiz 24.09.07 on all platforms allows an authenticated user holding only the LABEL_MANAGER_VIEW permission to read arbitrary properties and xml files on the server, including the generated JWT signing key, enabling forgery of an authenticated administrator session, via the fileName parameter of a ViewFile request.\nUsers are recommended to upgrade to version 24.09.08, which fixes this issue.","status":"published","published":"2026-11-05T15:32:37Z","modified":"2026-11-05T15:34:15Z","cwes":["CWE-73"],"updated_at":"2026-11-05T16:36:50.741706Z"}],"nvd":[{"id":"CVE-2026-97356","description":"External Control of File Name or Path vulnerability in the ViewFile component of Label Manager in Apache OFBiz 24.09.07 on all platforms allows an authenticated user holding only the LABEL_MANAGER_VIEW permission to read arbitrary properties and xml files on the server, including the generated JWT signing key, enabling forgery of an authenticated administrator session, via the fileName parameter of a ViewFile request.\nUsers are recommended to upgrade to version 24.09.08, which fixes this issue.","status":"published","published":"2026-11-05T14:17:07.643Z","modified":"2026-11-05T14:48:26.21Z","cwes":["CWE-73"],"updated_at":"2026-11-05T19:56:16.181209Z"}]}}