CVE-2024-1115 is a high-severity flaw in openBI, a business intelligence web application, with a CVSS score of 7.3. The record says versions up to 1.0.8 are affected and names no fixed release. Until you can confirm a patched build, treat internet exposure as the risk to remove first.
What's affected
The record lists openBI up to and including 1.0.8 as affected. The problem sits in the function dlfile of /application/websocket/controller/Setting.php, through the phpPath argument. Note this one is in a websocket controller, so a check that only covers normal HTTP routes can miss it.
The record names no fixed version, and the VulDB entry (VDB-252473) could not be read when I tried to fetch it. Check the openBI project directly for a patched release before you assume one exists.
How to check if you're exposed
Start with an inventory. Find every host that runs openBI and read the version from its install directory or deployment notes. Anything at or below 1.0.8 is in scope.
If you track dependencies and deployments in a repository, the free in-browser dependency scan will show whether openBI or a fork of it appears in your manifests. For a running server, look at your web access logs for requests to the path /application/websocket/controller/Setting.php from addresses you do not recognise. The advisory sources do not publish a fixed detection method, so treat log review as a hint and not a verdict.
What to do now
- Find every openBI instance and record its version and who can reach it.
- Check the project page and the VulDB entry for a fixed release. If none is published, plan to replace or retire the product.
- Take the instance off the public internet. Put it behind a VPN or an IP allow list while you decide.
- Review web server logs for the affected path and for unexpected changes on disk since the instance went live.
- Block or firewall the websocket port from untrusted networks, since the affected code is in a websocket controller.
- Add the product to your watch list so a later fix or follow up CVE reaches you quickly.
Why it matters
The weakness class is CWE-78 (improper neutralization of special elements in an OS command). OS command injection means data from a request ends up in a command the server runs. The record scores it 7.3, and the websocket controller is a less obvious entry point than the usual web routes.
Command injection is among the more damaging classes because it runs on the host. Run the service as a low privilege account so a flaw has less to work with. The record states the exploit has been disclosed to the public. It does not state active exploitation, and the CISA Known Exploited Vulnerabilities flag is false for this CVE.
Quick check
Is there a patched version of openBI?
The record names none. It only says versions up to 1.0.8 are affected. Check the project and the VulDB entry for the current state before relying on any version.
Is this exploited in the wild?
The record says an exploit has been disclosed publicly. It is not on the CISA KEV list, and no source I read reports active attacks.
Sources
Last reviewed: 19 October 2026.
