Path Traversal Vulnerability in Apache OFBiz Affects File Integrity

CVE-2026-76150

What is CVE-2026-76150?

A vulnerability exists in Apache OFBiz due to inadequate authorization checks in the replaceImageToExistImage service. This flaw allows remote authenticated attackers, even those with limited Catalog view permissions, to exploit this weakness by feeding crafted parameters to overwrite arbitrary files that are writable by the OFBiz process. The affected versions up to 24.09.07 are susceptible to unauthorized file manipulation if an attacker crafts specific inputs for productId, dataResourceNameExist, and dataResourceNameReplace. Users are urged to upgrade to version 24.09.08 to mitigate this risk and enhance overall security.

References