PT-2026-76911

CVE-2024-14046

Published

2026-08-18

Updated

2026-10-01

Description by

CVSS 2.0

6.5

Medium

MetricsAV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions OpenBoxes versions prior to 0.9.2

Description An unrestricted upload issue exists within the Document Upload Controller component. A remote attacker can exploit the DocumentController() function located in the grails-app/controllers/org/pih/warehouse/core/DocumentController.groovy file to upload files without proper restrictions.

Recommendations Update to version 0.9.2.

Exploitability

Exploit

Fix

Impacts

Researchers

Nedlir

Vendors

Affected products

Weakness enumeration

CWE-284: Improper Access Control

CWE-434: Unrestricted Upload of File with Dangerous Type