CVE-2024-32113

CVE-2024-32113: Apache OFBiz: Path traversal leading to RCE

Vendor Apache Software Foundation

Product Apache OFBiz

Weakness CWE-22 · Path traversal

KEV Status Known Exploited

Published May 8, 2024

Last update October 21, 2025

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz.This issue affects Apache OFBiz: before 18.12.13. Users are recommended to upgrade to version 18.12.13, which fixes the issue.

CISA mandated remediation

02CISA Required Action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Key dates

03Disclosure timeline

May 8, 2024 CVE published

October 21, 2025 Record updated

External resources

04References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-32113 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/22.html AskarLabs — CWE-22 write-up Path Traversal CISA KEV Reference https://lists.apache.org/thread/w6s60okgkxp2th1sr8vx0ndmgk68fqrd CISA KEV Reference https://nvd.nist.gov/vuln/detail/CVE-2024-32113

Related vulnerabilities

05Related CVE

CVE-2026-15990 Formidable Charts <= 2.0.1 - Unauthenticated Arbitrary File Read via 'frm_graph' Parameter CVE-2026-15450 NEX-Forms <= 9.2.3 - Authenticated (Admin+) Arbitrary File Deletion via Path Traversal via 'location' Parameter CVE-2026-13492 UsersWP <= 1.2.65 - Authenticated (Subscriber+) Arbitrary File Deletion via File Upload Field CVE-2026-11426 UnderConstructionPage PRO <= 5.76 - Authenticated (Subscriber+) Arbitrary File Read via template_thumbnail Parameter CVE-2026-65754 Joomla Extension - regularlabs.com - Insecure path handling in ReReplacer Pro extension