CVE-2024-35219

Deeper analysis

OpenAPI Generator is a tool that automatically produces API client libraries, server stubs, documentation, and configuration from an OpenAPI specification. Prior to version 7.6.0 the software contained a path traversal flaw (CWE-22) that could be triggered through the outputFolder parameter, enabling an attacker to read or delete arbitrary files and directories inside any writable location on the host.

An authenticated remote attacker with network access can submit a generation request that sets outputFolder to a chosen path. Because the option is honored without sufficient validation, the attacker can traverse outside the intended output directory and perform read or delete operations, resulting in information disclosure and integrity or availability impact.

The project’s security advisory and associated pull request state that the issue was resolved in release 7.6.0 by completely removing support for the outputFolder option; no workarounds are documented.

EPSS for the vulnerability rose from lower values to a peak of 0.7106 on 2026-02-03 before receding to the current score of 0.4012, indicating a period of increased exploitation interest after disclosure.