Description

A security vulnerability has been detected in OpenBoxes up to 0.9.1. This issue affects the function DocumentController of the file grails-app/controllers/org/pih/warehouse/core/DocumentController.groovy of the component Document Upload Controller. The manipulation leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 0.9.2 is capable of addressing this issue. The identifier of the patch is e945d6bfcec29642f514e7d298dfba2cc6cd7cd4. Upgrading the affected component is recommended.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-18T11:16:47.177Z",
  "pubdate": "2026-08-18T11:16:47.177Z",
  "executiveSummary": "An unrestricted file upload vulnerability exists within the DocumentController component of OpenBoxes up to 0.9.1, specifically residing in the file grails-app/controllers/org/pih/warehouse/core/DocumentController.groovy. This security flaw permits malicious remote actors to upload arbitrary files to the underlying server without adequate validation of file types, extensions, or contents. The realization of this vulnerability introduces severe risk implications, including remote code execution, system compromise, and unauthorized data exposure if an attacker uploads executable scripts into web-accessible directories. Exploitation of this vulnerability can be initiated entirely remotely, requiring network connectivity to the target application instance. Public disclosure of an exploit increases the urgency for defensive intervention. Remediation requires upgrading the affected component to version 0.9.2 or applying the vendor-supplied patch identified by commit hash e945d6bfcec29642f514e7d298dfba2cc6cd7cd4 to establish strict file validation controls.",
  "technicalDetails": "The vulnerability is rooted in insufficient input validation and file sanitization logic implemented within the DocumentController function inside the grails-app/controllers/org/pih/warehouse/core/DocumentController.groovy file of OpenBoxes up to 0.9.1. Specifically, the application fails to adequately enforce whitelist-based restrictions on uploaded file extensions, MIME types, and file content structures during the document upload process.\nFrom an attack flow perspective, a remote unauthenticated or authenticated attacker interacts with the Document Upload Controller endpoint exposed by the application over the network. The attacker crafts an HTTP multipart/form-data request containing a malicious payload, such as a web shell or executable script disguised as or embedded within a document upload parameter. Because the vulnerable DocumentController lacks rigorous validation checks, the application processes the request and writes the arbitrary file directly to the server's file system.\nOnce the malicious payload is successfully written to the target environment, post-exploitation impact includes arbitrary remote code execution within the context of the application server user account. This facilitates further internal network reconnaissance, data exfiltration, or complete system compromise. The network exposure is broad, as the application accepts remote HTTP requests to initiate the attack. Addressing this technical defect requires enforcing strict validation routines that verify file extensions against a rigid whitelist, validating magic bytes for file type verification, and storing uploaded assets outside of the web root to prevent direct execution of untrusted scripts."
}