The vulnerability arises because the XmlDsDump screen action in Apache OFBiz 24.09 (up to but not including 24.09.08) performs file output using an unvalidated path supplied by the requester before performing the intended permission check. This flaw represents both CWE-73 (Relative Path Traversal) and CWE-862 (Missing Authorization), allowing an attacker who is authenticated but only possesses base webtools permissions to export any database entity, including sensitive UserLogin records with password hashes, to an arbitrary filesystem location that the OFBiz process can write. The attacker can also create new directories or truncate existing files, and the path can point to the web server’s document root, enabling defacement or the uploading of malicious content. This flaw constitutes a privilege escalation that allows data exfiltration and potential compromise of the web application.

The affected product is Apache OFBiz, a Java‑based open‑source ERP platform provided by the Apache Software Foundation. The vulnerability exists in all releases of the 24.09 series before the 24.09.08 update; any instance running 24.09 or earlier is susceptible. No other vendors or product versions are identified as affected in the CNA data.

No EPSS score is currently available, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score is not provided in the public data, but the flaw can be exploited by any authenticated user who has webtools base permissions, which are commonly granted to many roles. Because the attack only requires a valid OFBiz session and does not rely on supply‑chain steps or complex prerequisites, the likelihood of exploitation is considered moderate to high in environments where such accounts exist and the webtools interface is accessible. An attacker can directly download entity data or write arbitrary files, potentially exposing credentials or defacing a website.