Unrated

Path traversal and missing authorization check in the replaceImageToExistImage service in Apache...

CVE-2026-76150 First seen on SecPulse Nov 5, 23:09

Affected packages

Ecosystem	Package	Affected	Fixed
Apache Software Foundation	Apache OFBiz	< 24.09.08	24.09.08

Original description The description as published by the source.

Path traversal and missing authorization check in the replaceImageToExistImage service in Apache OFBiz through 24.09.07 on all platforms allows a remote authenticated attacker with only Catalog view permission to overwrite arbitrary files writable by the OFBiz process with JPEG-encoded content via crafted productId, dataResourceNameExist, and dataResourceNameReplace parameters. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory

References

Key facts

Severity: Unrated
Published: Nov 6, 2026
First seen on SecPulse: Nov 5, 23:09
GHSA: GHSA-mvr7-jm24-r3fm
CWE: CWE-22 CWE-862

NVD GitHub Advisory

Tags(click for explanation)

Web Frameworks

Apache

Attack Types

Path Traversal

CWE

CWE-22 CWE-862

All

Apache Software Foundation Apache Ofbiz

Detection sources

NIST National Vulnerability Database00:17
GitHub Security Advisories (Global)00:34
CVE.org (CVE Program・cvelistV5)Nov 5, 23:09