CVE-2024-1035 is a high-severity flaw in openBI, a business intelligence web application, with a CVSS score of 7.3. The record says versions up to 1.0.8 are affected and names no fixed release. Until you can confirm a patched build, treat internet exposure as the risk to remove first.
What's affected
The record lists openBI up to and including 1.0.8 as affected. The problem sits in the function uploadIcon of /application/index/controller/Icon.php, through the image argument. The record rates it 7.3 with a network vector, no privileges and no user interaction.
The record names no fixed version, and the VulDB entry (VDB-252310) could not be read when I tried to fetch it. Check the openBI project directly for a patched release before you assume one exists.
How to check if you're exposed
Start with an inventory. Find every host that runs openBI and read the version from its install directory or deployment notes. Anything at or below 1.0.8 is in scope.
If you track dependencies and deployments in a repository, the free in-browser dependency scan will show whether openBI or a fork of it appears in your manifests. For a running server, look at your web access logs for requests to the path /application/index/controller/Icon.php from addresses you do not recognise. The advisory sources do not publish a fixed detection method, so treat log review as a hint and not a verdict.
What to do now
- Find every openBI instance and record its version and who can reach it.
- Check the project page and the VulDB entry for a fixed release. If none is published, plan to replace or retire the product.
- Take the instance off the public internet. Put it behind a VPN or an IP allow list while you decide.
- Review web server logs for the affected path and for unexpected changes on disk since the instance went live.
- Make sure upload folders cannot execute scripts, and remove any file there you did not put there.
- Add the product to your watch list so a later fix or follow up CVE reaches you quickly.
Why it matters
The weakness class is CWE-434 (unrestricted upload of a file with a dangerous type). Unrestricted file upload means the server accepts a file without checking its type, name or destination properly. On a PHP application, an upload that lands in a web served folder can become code that the server runs.
In practice an upload endpoint is the first place to harden. Keep uploads outside the web root, check the file type on the server and not only in the browser, and store files under names you generate yourself. The record states the exploit has been disclosed to the public. It does not state active exploitation, and the CISA Known Exploited Vulnerabilities flag is false for this CVE.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is there a patched version of openBI?
The record names none. It only says versions up to 1.0.8 are affected. Check the project and the VulDB entry for the current state before relying on any version.
Is this exploited in the wild?
The record says an exploit has been disclosed publicly. It is not on the CISA KEV list, and no source I read reports active attacks.
Sources
Last reviewed: 19 October 2026.
