CVE-2026-76150: Apache OFBiz: Authenticated path traversal and missing authorization check in replaceImageToExistImage
Published Nov 5, 2026
·Updated
Path traversal and missing authorization check in the replaceImageToExistImage service in Apache OFBiz through 24.09.07 on all platforms allows a remote authenticated attacker with only Catalog view permission to overwrite arbitrary files writable by the OFBiz process with JPEG-encoded content via crafted productId, dataResourceNameExist, and dataResourceNameReplace parameters. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache OFBizto a version that resolves this vulnerability.Fixed in 24.09.08
Event History
Nov 5, 2026
CVE Published
via MITRE·02:09 PM
Data Sourced
via MITRE·02:09 PM
DescriptionWeakness
Data Sourced
via NVD·03:17 PM
DescriptionWeakness