From 9cc202fb7627bf16f89a66bdd67b253d799cbd9d Mon Sep 17 00:00:00 2001
From: Jacopo Cappellato <jacopo.cappellato@gmail.com>
Date: Mon, 6 Apr 2026 09:34:15 +0200
Subject: [PATCH 1/2] Fixed: Move checkContextFileBoundary call to ensure file
 boundary is checked before existence check

(cherry picked from commit 5b4fe028fda361dc83053c76d0138fe22b095148)
---
 .../java/org/apache/ofbiz/content/data/DataResourceWorker.java  | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/applications/content/src/main/java/org/apache/ofbiz/content/data/DataResourceWorker.java b/applications/content/src/main/java/org/apache/ofbiz/content/data/DataResourceWorker.java
index 6eb632362b0..f2f84726474 100644
--- a/applications/content/src/main/java/org/apache/ofbiz/content/data/DataResourceWorker.java
+++ b/applications/content/src/main/java/org/apache/ofbiz/content/data/DataResourceWorker.java
@@ -715,10 +715,10 @@ public static File getContentFile(String dataResourceTypeId, String objectInfo,
                 sep = "/";
             }
             file = FileUtil.getFile(contextRoot + sep + objectInfo);
+            checkContextFileBoundary(file, contextRoot);
             if (!file.exists()) {
                 throw new FileNotFoundException("No file found: " + (contextRoot + sep + objectInfo));
             }
-            checkContextFileBoundary(file, contextRoot);
         }
 
         return file;

From 6d6b9b2587990826002ef3e74f86f0c2eb552a9e Mon Sep 17 00:00:00 2001
From: Jacopo Cappellato <jacopo.cappellato@gmail.com>
Date: Mon, 6 Apr 2026 11:06:02 +0200
Subject: [PATCH 2/2] Fixed: Update checkContextFileBoundary method visibility
 and ensure it is called in DataServices to validate file paths

(cherry picked from commit 44c9055e1601d5acdded5c393f49b2c2df6b5550)
---
 .../apache/ofbiz/content/data/DataResourceWorker.java  |  4 ++--
 .../org/apache/ofbiz/content/data/DataServices.java    | 10 ++++++++++
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/applications/content/src/main/java/org/apache/ofbiz/content/data/DataResourceWorker.java b/applications/content/src/main/java/org/apache/ofbiz/content/data/DataResourceWorker.java
index f2f84726474..01400c80670 100644
--- a/applications/content/src/main/java/org/apache/ofbiz/content/data/DataResourceWorker.java
+++ b/applications/content/src/main/java/org/apache/ofbiz/content/data/DataResourceWorker.java
@@ -541,7 +541,7 @@ private static void checkOfbizFileAllowList(File file) throws GeneralException {
     /**
      * Checks that the given file is within the provided context root directory.
      */
-    private static void checkContextFileBoundary(File file, String contextRoot) throws GeneralException {
+    static void checkContextFileBoundary(File file, String contextRoot) throws GeneralException {
         try {
             String canonicalAllowed = new File(contextRoot).getCanonicalPath();
             String canonicalFilePath = file.getCanonicalPath();
@@ -1282,10 +1282,10 @@ public static void renderFile(String dataResourceTypeId, String objectInfo, Stri
                 sep = "/";
             }
             File file = FileUtil.getFile(prefix + sep + objectInfo);
+            checkContextFileBoundary(file, rootDir);
             if (!file.exists()) {
                 throw new FileNotFoundException("No file found: " + file.getAbsolutePath());
             }
-            checkContextFileBoundary(file, rootDir);
             try (InputStreamReader in = new InputStreamReader(new FileInputStream(file), StandardCharsets.UTF_8)) {
                 if (Debug.infoOn()) {
                     String enc = in.getEncoding();
diff --git a/applications/content/src/main/java/org/apache/ofbiz/content/data/DataServices.java b/applications/content/src/main/java/org/apache/ofbiz/content/data/DataServices.java
index 56a618a18e7..2feed5755d6 100644
--- a/applications/content/src/main/java/org/apache/ofbiz/content/data/DataServices.java
+++ b/applications/content/src/main/java/org/apache/ofbiz/content/data/DataServices.java
@@ -268,6 +268,11 @@ public static Map<String, Object> createFileMethod(DispatchContext dctx, Map<Str
                 sep = "/";
             }
             file = new File(prefix + sep + objectInfo);
+            try {
+                DataResourceWorker.checkContextFileBoundary(file, prefix);
+            } catch (GeneralException e) {
+                return ServiceUtil.returnError(e.getMessage());
+            }
         }
         if (file == null) {
             return ServiceUtil.returnError(UtilProperties.getMessage(RESOURCE, "ContentUnableObtainReferenceToFile",
@@ -478,6 +483,11 @@ public static Map<String, Object> updateFileMethod(DispatchContext dctx, Map<Str
                     sep = "/";
                 }
                 file = new File(prefix + sep + objectInfo);
+                try {
+                    DataResourceWorker.checkContextFileBoundary(file, prefix);
+                } catch (GeneralException e) {
+                    return ServiceUtil.returnError(e.getMessage());
+                }
             }
             if (file == null) {
                 throw new IOException("File is null");