CVE-2024-14046
OpenBoxes Document Upload Controller DocumentController.groovy DocumentController unrestricted upload
CVSS Score
6.3
EPSS Score
0.0%
EPSS Percentile
0th
A security vulnerability has been detected in OpenBoxes up to 0.9.1. This issue affects the function DocumentController of the file grails-app/controllers/org/pih/warehouse/core/DocumentController.groovy of the component Document Upload Controller. The manipulation leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 0.9.2 is capable of addressing this issue. The identifier of the patch is e945d6bfcec29642f514e7d298dfba2cc6cd7cd4. Upgrading the affected component is recommended.
| CWE | CWE-434 CWE-284 |
| Vendor | n/a |
| Product | openboxes |
| Published | Aug 18, 2026 |
Stay Ahead of the Next One
Get instant alerts for n/a openboxes
Be the first to know when new medium vulnerabilities affecting n/a openboxes are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
n/a / OpenBoxes
0.9.0 0.9.1
References
vuldb.com: https://vuldb.com/vuln/391110 vuldb.com: https://vuldb.com/vuln/391110/cti vuldb.com: https://vuldb.com/cve/CVE-2024-14046 vuldb.com: https://vuldb.com/submit/872701 gist.github.com: https://gist.github.com/nedlir/744e55b267daab6f74b76bdc6f0d711d github.com: https://github.com/openboxes/openboxes/pull/4764 github.com: https://github.com/openboxes/openboxes/commit/e945d6bfcec29642f514e7d298dfba2cc6cd7cd4 github.com: https://github.com/openboxes/openboxes/releases/tag/v0.9.2 github.com: https://github.com/openboxes/openboxes/
Credits
🔍 nedlir (VulDB User)