Authenticated Path Traversal in Apache OFBiz Image Management
CVE-2026-66903

Currently unrated

Key Information:

Vendor

Apache
Status
Apache Ofbiz
Vendor
CVE Published:
5 November 2026

What is CVE-2026-66903?

An authenticated path traversal vulnerability in the Catalog Image Management component of Apache OFBiz allows users to write image files outside the permissible directory. This misconfiguration can lead to unauthorized access and manipulation of files on the server. It is recommended that users upgrade to version 24.09.08 to mitigate this issue.

Affected Version(s)

Apache OFBiz 0 < 24.09.08

References

https://lists.apache.org/thread.html/7b2syzksp7klt9fvhdg0...
vendor-advisory

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Adrián Leal / 4lec4st
.