CVE-2024-35219: OpenAPI Generator Path Traversal Flaw

CVE-2024-35219 Overview

CVE-2024-35219 is a path traversal vulnerability in OpenAPI Generator, a tool that generates API client libraries, server stubs, documentation, and configuration files from an OpenAPI specification. The flaw exists in the online service component, where the outputFolder option in a request could be set to an arbitrary path. Authenticated attackers can read and delete files and folders from any writable directory on the host. The issue affects all versions prior to 7.6.0 and is tracked under CWE-22: Improper Limitation of a Pathname to a Restricted Directory.

Critical Impact
Attackers with access to the OpenAPI Generator online service can traverse the filesystem to arbitrarily delete or overwrite files, leading to integrity loss and denial of service.

Affected Products

OpenAPI Generator versions prior to 7.6.0
openapi-generator-online module (Generator service)
Deployments exposing the OpenAPI Generator online API for SDK generation

Discovery Timeline

2024-05-27 - CVE-2024-35219 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-35219

Vulnerability Analysis

OpenAPI Generator exposes an online generation service that accepts an OpenAPI specification along with a set of options. Among these options is outputFolder, which controls where generated artifacts are written. The service concatenated this user-supplied value directly onto a temporary base directory without validating or normalizing path components. An attacker could supply a value containing ../ sequences to escape the intended output directory. Because the generator writes and clears the target folder as part of its normal workflow, exploitation results in arbitrary file and directory deletion on the server. The vulnerability is categorized as a Path Traversal weakness under [CWE-22]. The EPSS score of 3.592% (88.4 percentile) indicates elevated exploitation likelihood compared to the average CVE.

Root Cause

The root cause is unsafe use of the outputFolder option in modules/openapi-generator-online/src/main/java/org/openapitools/codegen/online/service/Generator.java. The service trusted the caller-supplied outputFolder value and appended it to the temporary base path, allowing ../ traversal to write to any location the server process could reach.

Attack Vector

An attacker submits a crafted request to the online generator API with an OpenAPI spec plus an options map that sets outputFolder to a traversal path such as ../../etc. The server resolves the path outside the temporary sandbox and performs file operations there, deleting or overwriting existing content. No user interaction is required beyond authenticating to the service.

java

            throw new ResponseStatusException(HttpStatus.BAD_REQUEST, "The OpenAPI specification supplied was not valid");
        }

-        String destPath = null;
-
-        if (opts.getOptions() != null) {
-            destPath = opts.getOptions().get("outputFolder");
-        }
-        if (destPath == null) {
-            destPath = language + "-" + type.getTypeName();
-        }
+        // do not use opts.getOptions().get("outputFolder") as the input can contain ../../
+        // to access other folders in the server
+        String destPath = language + "-" + type.getTypeName();

        ClientOptInput clientOptInput = new ClientOptInput();
        String outputFolder = getTmpFolder().getAbsolutePath() + File.separator + destPath;

Source: GitHub commit edbb021. The patch removes the caller-controlled outputFolder value entirely and derives destPath from server-controlled inputs only (language and type.getTypeName()).

Detection Methods for CVE-2024-35219

Indicators of Compromise

HTTP requests to the OpenAPI Generator online API containing outputFolder values with ../, ..\\, or absolute paths
Unexpected file deletions, truncations, or new directories under paths outside the generator's temporary working directory
Java process activity from openapi-generator-online writing to system-sensitive paths such as /etc, /var, or user home directories
Errors or 5xx responses from the generator service correlated with filesystem changes on the host

Detection Strategies

Inspect application logs and reverse-proxy access logs for options.outputFolder request fields containing path traversal sequences
Enable filesystem auditing on the OpenAPI Generator host and alert on writes or deletions outside the designated temporary folder
Compare running generator versions against the fixed release 7.6.0 in software inventory tooling

Monitoring Recommendations

Ingest OpenAPI Generator service logs and host filesystem telemetry into a centralized data lake for correlation
Alert on any child process of the generator that touches paths outside the temporary sandbox
Track outbound and inbound traffic to the generator API and require authentication plus network segmentation for internal deployments

How to Mitigate CVE-2024-35219

Immediate Actions Required

Upgrade OpenAPI Generator to version 7.6.0 or later on all servers that host the online generator service
Restrict network access to the online generator so that only trusted internal callers can submit generation requests
Audit filesystem state on generator hosts for evidence of prior traversal attempts and restore any deleted files from backup

Patch Information

The fix landed in Pull Request #18652 and commit edbb021aadae47dcfe690313ce5119faf77f800d, released in version 7.6.0. See the GitHub Security Advisory GHSA-g3hr-p86p-593h for full details. The advisory notes that no workarounds are available for affected versions.

Workarounds

No official workarounds exist; upgrading to 7.6.0 is the only supported remediation
If upgrade is not immediately possible, take the online generator service offline or restrict it to a hardened, isolated host with minimal filesystem privileges
Run the generator process as a dedicated low-privilege service account with write access only to its temporary working directory

bash

# Verify the installed OpenAPI Generator version and upgrade
openapi-generator-cli version

# Example upgrade using npm-based distribution
npm install @openapitools/openapi-generator-cli@^7.6.0 -g

# For Docker deployments, pin the fixed image tag
docker pull openapitools/openapi-generator-online:v7.6.0