CVE-2024-14046: Unrestricted Upload in OpenBoxes
A security vulnerability has been detected in OpenBoxes up to 0.9.1. This issue affects the function DocumentController of the file grails-app/controllers/org/pih/warehouse/core/DocumentController.groovy of the component Document Upload Controller. The manipulation leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 0.9.2 is capable of addressing this issue. The identifier of the patch is e945d6bfcec29642f514e7d298dfba2cc6cd7cd4. Upgrading the affected component is recommended.
AI Analysis
Technical Summary
This vulnerability affects the DocumentController component in OpenBoxes up to version 0.9.1, specifically in the file grails-app/controllers/org/pih/warehouse/core/DocumentController.groovy. It allows an attacker with low privileges to remotely upload files without restriction, potentially leading to unauthorized file storage or execution. The issue has been publicly disclosed, and upgrading to version 0.9.2, which includes the patch identified by commit e945d6bfcec29642f514e7d298dfba2cc6cd7cd4, mitigates the vulnerability.
Potential Impact
An attacker can remotely upload files without restriction, which may lead to unauthorized file storage or further exploitation depending on the server configuration. The vulnerability requires low privileges and no user interaction, increasing the risk of exploitation. However, no active exploits have been reported in the wild.
Mitigation Recommendations
Upgrade OpenBoxes to version 0.9.2 or later, which contains the official fix for this vulnerability. Since this is a cloud service, the vendor manages remediation for hosted instances; verify with the vendor that the service is updated. No additional mitigation steps are specified by the vendor advisory.
CVE-2024-14046: Unrestricted Upload in OpenBoxes
Description
A security vulnerability has been detected in OpenBoxes up to 0.9.1. This issue affects the function DocumentController of the file grails-app/controllers/org/pih/warehouse/core/DocumentController.groovy of the component Document Upload Controller. The manipulation leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 0.9.2 is capable of addressing this issue. The identifier of the patch is e945d6bfcec29642f514e7d298dfba2cc6cd7cd4. Upgrading the affected component is recommended.
CVSS v4.0
Score 5.3medium
Affected software
pkg:github/openboxes/openboxescpe:2.3:a:openboxes:openboxes:*:*:*:*:*:*:*:*Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability affects the DocumentController component in OpenBoxes up to version 0.9.1, specifically in the file grails-app/controllers/org/pih/warehouse/core/DocumentController.groovy. It allows an attacker with low privileges to remotely upload files without restriction, potentially leading to unauthorized file storage or execution. The issue has been publicly disclosed, and upgrading to version 0.9.2, which includes the patch identified by commit e945d6bfcec29642f514e7d298dfba2cc6cd7cd4, mitigates the vulnerability.
Potential Impact
An attacker can remotely upload files without restriction, which may lead to unauthorized file storage or further exploitation depending on the server configuration. The vulnerability requires low privileges and no user interaction, increasing the risk of exploitation. However, no active exploits have been reported in the wild.
Mitigation Recommendations
Upgrade OpenBoxes to version 0.9.2 or later, which contains the official fix for this vulnerability. Since this is a cloud service, the vendor manages remediation for hosted instances; verify with the vendor that the service is updated. No additional mitigation steps are specified by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-08-16T05:47:46.363Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
- Is Cloud Service
- true
Threat ID: 6a8436f3bf8831d539a100c2
Added to database: 08/18/2026, 10:41:55 UTC
Last enriched: 08/18/2026, 10:54:33 UTC
Last updated: 08/18/2026, 11:33:03 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.