Medium
6.5
Authenticated Path Traversal in Catalog Image Management allows writing image files outside the...
CVE-2026-66903
First seen on SecPulse
Affected packages
| Ecosystem | Package | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache OFBiz |
< 24.09.08 |
24.09.08 |
Original description The description as published by the source.
Authenticated Path Traversal in Catalog Image Management allows writing image files outside the intended directory in Apache OFBiz.
This issue affects Apache OFBiz: before 24.09.08.
Users are recommended to upgrade to version 24.09.08, which fixes the issue.
Source: oss-security (Openwall) NVD GitHub Advisory
References
- OSS-SECURITY Apache OFBiz: CVE Announcements
- web lists.apache.org
- web nvd.nist.gov
- web github.com