Description
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz.This issue affects Apache OFBiz: before 18.12.13.
Users are recommended to upgrade to version 18.12.13, which fixes the issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache OFBiz | < 18.12.13 | 18.12.13 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
Apache OFBiz forgotPassword/ProgramExport RCE
exploit/multi/http/apache_ofbiz_forgot_password_directory_traversal
Exploit-DB 1
- Apache OFBiz 18.12.12 - Directory Traversal EDB-52020 · webapps · May 19, 2024
GitHub 5 repositories
-
Mr-xn/CVE-2024-32113 ★ 26 · Jun 3, 2024
Apache OFBIZ Path traversal leading to RCE POC[CVE-2024-32113 & CVE-2024-36104]
-
RacerZ-fighting/CVE-2024-32113-POC ★ 7 · Apr 10, 2024
Apache OfBiz vulns
-
YongYe-Security/CVE-2024-32113 ★ 6 · Aug 7, 2024
CVE-2024-32113 Apache OFBIZ Batch Scanning
-
luizgaf/CVE-2024-32113-Exploit ★ 0 · Oct 9, 2025
CVE-2024-32113-Apache-OFBiz<18.12.13-Exploit
-
guinea-offensive-security/Ofbiz-RCE ★ 0 · Jul 11, 2025
CVE-2024-32113 & CVE-2024-38856
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Apache OFBiz Directory Traversal - Remote Code Execution http/cves/2024/CVE-2024-32113.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Advisories 1
- WID-SEC-2024-1078 Apache OFBiz: Schwachstelle ermöglicht Codeausführung BSI CERT-Bund (WID) · May 20, 2024