CVE-2024-35219

OpenAPI Generator allows generation of API client libraries (SDK generation), server stubs, documentation and configuration automatically given an OpenAPI Spec. Prior to version 7.6.0, attackers can exploit a path traversal vulnerability to read and delete files and folders from an arbitrary, writable directory as anyone can set the output folder when submitting the request via the `outputFolder` option. The issue was fixed in version 7.6.0 by removing the usage of the `outputFolder` option. No known workarounds are available.

• CWE-22

• https://github.com/OpenAPITools/openapi-generator/commit/edbb021aadae47dcfe690313ce5119faf77f800d
• https://github.com/OpenAPITools/openapi-generator/pull/18652
• https://github.com/OpenAPITools/openapi-generator/security/advisories/GHSA-g3hr-p86p-593h
• https://github.com/OpenAPITools/openapi-generator/commit/edbb021aadae47dcfe690313ce5119faf77f800d
• https://github.com/OpenAPITools/openapi-generator/pull/18652
• https://github.com/OpenAPITools/openapi-generator/security/advisories/GHSA-g3hr-p86p-593h

Published

May 27, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-35211A vulnerability has been identified in SINEC Traffic Analyze…6.8
• CVE-2024-35212A vulnerability has been identified in SINEC Traffic Analyze…6.9
• CVE-2024-35213An improper input validation vulnerability in the SGI Image …9
• CVE-2024-35214A tampering vulnerability in the CylanceOPTICS Windows Insta…7.1
• CVE-2024-35215NULL pointer dereference in IP socket options processing of …6.2
• CVE-2024-35218Umbraco CMS is an ASP.NET CMS used by more than 730.000 webs…4.8
• CVE-2024-3522A vulnerability classified as critical has been found in Cam…8.8
• CVE-2024-35220@fastify/session is a session plugin for fastify. Requires t…7.4
• CVE-2024-35221Rubygems.org is the Ruby community's gem hosting service. A …4.3
• CVE-2024-35222Tauri is a framework for building binaries for all major des…5.9
• CVE-2024-35223Dapr is a portable, event-driven, runtime for building distr…5.3
• CVE-2024-35224OpenProject is the leading open source project management so…5.4