Apache OFBiz contains a combination of path traversal, stored cross‑site scripting, and code injection weaknesses in the catalog manager. An attacker who can control upload filenames can move outside the intended storage directory, causing an arbitrary overwriting or creation of files, including web‑accessible scripts. Through stored XSS the attacker can hijack sessions or deliver malicious content, while code injection permits execution of arbitrary code, effectively enabling remote code execution.

Apache OFBiz versions earlier than 24.09.06.

The vulnerability can result in RCE, with a CVSS score of 6.1 indicating moderate severity. The EPSS score is less than 1%, suggesting a low probability of exploitation, and it is not listed in CISA KEV. The combination of path traversal and code injection gives attackers a clear path once the upload interface is reachable; while the attack may require authenticated access to the catalog manager, it can be inferred that it is exploitable via normal user interaction.