CVE-2026-66903: Apache OFBiz: Authenticated Path Traversal in Catalog Image Management

Published Nov 5, 2026

Updated

Authenticated Path Traversal in Catalog Image Management allows writing image files outside the intended directory in Apache OFBiz.

This issue affects Apache OFBiz: before 24.09.08.

Users are recommended to upgrade to version 24.09.08, which fixes the issue.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache OFBiz to a version that resolves this vulnerability.
Fixed in 24.09.08

Event History

Nov 5, 2026

CVE Published

via MITRE·02:12 PM

Data Sourced

via MITRE·02:12 PM

DescriptionWeakness

Data Sourced

via NVD·03:17 PM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker must be authenticated to Apache OFBiz and able to use the Catalog Image Management functionality. The available information does not identify which authenticated roles or permissions are sufficient.

Which deployments are affected?

Apache OFBiz versions before 24.09.08 are affected. Version 24.09.08 fixes the issue.

What is the impact of successful exploitation?

An authenticated attacker can write image files outside the intended directory through path traversal in Catalog Image Management. The provided information does not specify which filesystem locations are writable or whether further code execution is possible.

CVE-2026-66903: Apache OFBiz: Authenticated Path Traversal in Catalog Image Management

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

Which deployments are affected?

What is the impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Which deployments are affected?

What is the impact of successful exploitation?