Apache OFBiz allows low‑privilege users to supply a crafted filename to the content component, resulting in a path traversal exploit. By manipulating the pathname, an attacker can read arbitrary files from the server, such as configuration files, logs, or credentials. This flaw corresponds to CWE‑22 and provides confidentiality exposure without requiring elevated privileges.

Any deployment of Apache OFBiz older than version 24.09.06 is affected. The vulnerability exists in the Content component of the framework, and all potential instances where the component is enabled and accessible via a web interface are vulnerable.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, indicating a lack of publicly known exploitation. The attack vector is web‑based: an unauthenticated or low‑privilege user can trigger the flaw by accessing a URL that passes a filename to the content service. The real‑world risk is moderate, concentrated on confidentiality leakage, and no remote code execution is implied by the current description.