Apache OFBiz allows low‑privilege users to supply a crafted filename to the content component, resulting in a path traversal exploit. By manipulating the pathname, an attacker can read arbitrary files from the server, such as configuration files, logs, or credentials. This flaw corresponds to CWE‑22 and provides confidentiality exposure without requiring elevated privileges.

Any deployment of Apache OFBiz older than version 24.09.06 is affected. The vulnerability exists in the Content component of the framework, and all potential instances where the component is enabled and accessible via a web interface are vulnerable.

The EPSS score of < 1% and a CVSS score of 6.5 indicate a moderate likelihood and impact. The vulnerability is not listed in the CISA KEV catalog, suggesting no publicly known exploitation yet. Based on the description, the likely attack vector is a web‑based request where an attacker can supply a crafted filename to the content service, potentially triggering path traversal. The real‑world risk is moderate, concentrated on confidentiality leakage, and no remote code execution is implied by the current description.