What is the CVSS score of CVE-2026-29220?

CVE-2026-29220 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-29220?

Yes, a patch is available for CVE-2026-29220. Update the affected software to the latest version immediately.

Apache OFBiz CVE-2026-29220

EUVD-2026-30852 MEDIUM

Path Traversal (CWE-22)

2026-05-19 apache

GHSA-p9mw-926p-xf85

Apache Path Traversal Apache Ofbiz Apache Software Foundation

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

vuln.today AI

6.5 MEDIUM

Network-reachable, unauthenticated path traversal (AV:N/PR:N) yields partial file read and write (C:L/I:L) with no availability impact; low complexity, no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 17:56 vuln.today

Patch available

May 19, 2026 - 11:16 EUVD

CVE Published

May 19, 2026 - 09:16 nvd

UNKNOWN (no severity yet)

CVE Published

May 19, 2026 - 09:16 cve.org

MEDIUM 6.5

DescriptionCVE.org

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz.

This issue affects Apache OFBiz: before 24.09.06.

Users are recommended to upgrade to version 24.09.06, which fixes the issue.

AnalysisAI

Path traversal in Apache OFBiz before 24.09.06 exposes unauthenticated remote attackers to file read and limited file write capabilities outside the application's intended directory boundaries. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this requires no authentication, no user interaction, and no special network position against any internet-exposed OFBiz instance. No public exploit has been identified at time of analysis and EPSS sits at 0.02% (6th percentile), but SSVC flags the attack as automatable - meaning if tooling emerges, mass internet scanning becomes feasible.

Technical ContextAI

Apache OFBiz is an open-source Java-based enterprise resource planning (ERP) and e-commerce framework maintained by the Apache Software Foundation. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), which arises when user-supplied input - typically URL path segments or request parameters - is used to construct filesystem paths without adequate canonicalization or boundary enforcement. Attackers can inject sequences such as ../, %2e%2e%2f, or other encoded variants to escape the webroot sandbox. The CPE (cpe:2.3:a:apache_software_foundation:apache_ofbiz:*:*:*:*:*:*:*:*) confirms every release prior to 24.09.06 is within scope. OFBiz exposes numerous HTTP endpoints across its view layer and controller framework, providing broad attack surface for path traversal probing.

RemediationAI

Vendor-released patch: Apache OFBiz 24.09.06. Organizations should upgrade to this version as the primary remediation, following Apache's release notes and the advisory at https://lists.apache.org/thread/5hjnmt9no6mmtg8sxq3mhonzff1vkd5m. If immediate upgrade is blocked by change-control timelines, deploy WAF rules blocking common path traversal patterns (e.g., ../, %2e%2e, %252e%252e) against OFBiz HTTP endpoints - note that WAF-only controls may be bypassed by novel encoding and should be treated as temporary. Additionally, restricting external network access to OFBiz via a reverse proxy or network ACL, and running the OFBiz process under a least-privilege OS account with minimal filesystem access, limits the data an attacker can reach if exploitation occurs.