Read the docs
TI-2024-23289 Aliases CVE-2024-35219GHSA-g3hr-p86p-593h

OpenAPI Generator Online - Arbitrary File Read/Delete

Priority HIGH 69CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

OpenAPI Generator allows generation of API client libraries (SDK generation), server stubs, documentation and configuration automatically given an OpenAPI Spec. Prior to version 7.6.0, attackers can exploit a path traversal vulnerability to read and delete files and folders from an arbitrary, writable directory as anyone can set the output folder when submitting the request via the `outputFolder` option. The issue was fixed in version 7.6.0 by removing the usage of the `outputFolder` option. No known workarounds are available.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.03592 89th percentileScored 2026-11-07
Fix Fixed openapi-generator (OpenAPITools): 7.6.0org.openapitools:openapi-generator-online (Maven): 7.6.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
OpenAPIToolsopenapi-generatorbefore 7.6.07.6.0Patch availableCNA
—org.openapitools:openapi-generator-online (Maven)before 7.6.07.6.0Patch availableGHSA-g3hr-p86p-593h
  • openapi-generator VendorOpenAPITools Affected before 7.6.0 Fixed in 7.6.0 Patch available CNA
  • org.openapitools:openapi-generator-online (Maven) Vendor— Affected before 7.6.0 Fixed in 7.6.0 Patch available GHSA-g3hr-p86p-593h

CPE names CISA-ADP · 1

CPEVersionsRoleVendor
cpe:2.3:a:openapitools:openapi-generator:*:*:*:*:*:*:*:*———
  • cpe:2.3:a:openapitools:openapi-generator:*:*:*:*:*:*:*:* Versions — — ·—

Remediation

  • Fix · CNA openapi-generator (OpenAPITools) Fixed in 7.6.0
  • Fix · GHSA-g3hr-p86p-593h org.openapitools:openapi-generator-online (Maven) Fixed in 7.6.0 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Not affected: 3 products
  • OpenShift Serverless
  • Red Hat Fuse 7
  • streams for Apache Kafka

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-35219
  2. 2026-10-03 Alias added: GHSA-g3hr-p86p-593h

References

Advisory 1

Other 4

  • TI-2023-11951 openapi-generator up to v6.4.0 was discovered to contain a Server-Side Request Forgery… CVSS 3.1CRITICAL 9.1
  • TI-2021-04526 Creation of Temporary File in Directory with Insecure Permissions in the OpenAPI-Generator online generator CVSS 3.1CRITICAL 9.3
  • TI-2019-08521 OpenAPI Tools OpenAPI Generator before 4.0.0-20190419.052012-560 uses http:// URLs in… CVSS 3.0HIGH 8.1
  • TI-2021-04528 Creation of Temporary File in Directory with Insecure Permissions in auto-generated Java, Scala code CVSS 3.1MEDIUM 6.2
  • TI-2021-04527 Creation of Temporary File in Directory with Insecure Permissions in the OpenAPI Generator Maven plugin CVSS 3.1MEDIUM 4.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences