PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-31379 Apache Software Foundation CVE debrief

Apache OFBiz versions prior to 24.09.06 contain multiple vulnerability classes: Cross-site Scripting (CWE-79), Path Traversal (CWE-22), and Code Injection (CWE-94). The vendor published advisory details on 2026-05-19. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope change, with low impacts to confidentiality and integrity. No availability impact is scored. The vendor recommends upgrading to version 24.09.06 to remediate these issues. No known exploitation in ransomware campaigns has been reported.

Vendor
Apache Software Foundation
Product
Apache OFBiz
CVSS
MEDIUM 6.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-19
Original CVE updated
2026-05-19
Advisory published
2026-05-19
Advisory updated
2026-05-19

Who should care

Organizations running Apache OFBiz versions prior to 24.09.06, particularly those with externally accessible deployments or multi-tenant environments where scope change impacts could amplify risk across trust boundaries.

Technical summary

Apache OFBiz before 24.09.06 is affected by three vulnerability types: improper neutralization of input during web page generation (XSS/CWE-79), improper limitation of pathname to restricted directory (Path Traversal/CWE-22), and improper control of code generation (Code Injection/CWE-94). The CVSS 3.1 score of 6.1 (Medium) reflects network accessibility with required user interaction and scope change. Successful exploitation could allow attackers to execute scripts in user browsers, access files outside intended directories, or inject and execute arbitrary code. The vendor has released version 24.09.06 containing fixes.

Defensive priority

medium

Recommended defensive actions

  • Upgrade Apache OFBiz to version 24.09.06 or later
  • Review application logs for suspicious input patterns consistent with XSS, path traversal, or code injection attempts
  • Validate that web application firewalls or input filtering rules address the identified CWE classes
  • Monitor Apache OFBiz security mailing lists for additional guidance

Evidence notes

CWE-79 (XSS), CWE-22 (Path Traversal), and CWE-94 (Code Injection) are explicitly listed as weakness enumerations. CPE criteria confirms affected versions are all versions before 24.09.06. CVSS vector and score derived from NVD source data.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-31379 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-31379

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-31379 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-31379

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.