CVE-2024-1116 is a high-severity flaw in openBI, a business intelligence web application, with a CVSS score of 7.3. The record says versions up to 1.0.8 are affected and names no fixed release. Until you can confirm a patched build, treat internet exposure as the risk to remove first.
What's affected
The record lists openBI up to and including 1.0.8 as affected. The problem sits in the function index of /application/plugins/controller/Upload.php. The record scores it 7.3 and says the attack can be launched remotely.
The record names no fixed version, and the VulDB entry (VDB-252474) could not be read when I tried to fetch it. Check the openBI project directly for a patched release before you assume one exists.
How to check if you're exposed
Start with an inventory. Find every host that runs openBI and read the version from its install directory or deployment notes. Anything at or below 1.0.8 is in scope.
If you track dependencies and deployments in a repository, the free in-browser dependency scan will show whether openBI or a fork of it appears in your manifests. For a running server, look at your web access logs for requests to the path /application/plugins/controller/Upload.php from addresses you do not recognise. The advisory sources do not publish a fixed detection method, so treat log review as a hint and not a verdict.
What to do now
- Find every openBI instance and record its version and who can reach it.
- Check the project page and the VulDB entry for a fixed release. If none is published, plan to replace or retire the product.
- Take the instance off the public internet. Put it behind a VPN or an IP allow list while you decide.
- Review web server logs for the affected path and for unexpected changes on disk since the instance went live.
- Check the plugins directory for files you did not install.
- Add the product to your watch list so a later fix or follow up CVE reaches you quickly.
Why it matters
The weakness class is CWE-434 (unrestricted upload of a file with a dangerous type). Unrestricted upload accepts files the server should reject. Here it is the plugins upload controller.
A plugin upload route may be intended for administrators only. Confirm that the route requires a login on your deployment and that nothing public can reach it. The record states the exploit has been disclosed to the public. It does not state active exploitation, and the CISA Known Exploited Vulnerabilities flag is false for this CVE.
Quick check
Is there a patched version of openBI?
The record names none. It only says versions up to 1.0.8 are affected. Check the project and the VulDB entry for the current state before relying on any version.
Is this exploited in the wild?
The record says an exploit has been disclosed publicly. It is not on the CISA KEV list, and no source I read reports active attacks.
Sources
Last reviewed: 19 October 2026.
