Path Traversal and Missing Authorization in Apache OFBiz

CVE-2026-76152

What is CVE-2026-76152?

A security vulnerability in Apache OFBiz versions up to 24.09.07 permits a remote authenticated attacker with Catalog view permission to exploit the imageCrop and imageRotate services. This could enable the attacker to read sensitive image files accessible to the OFBiz process and to write re-encoded images to unauthorized directories. To mitigate this risk, users are advised to update to version 24.09.08, which provides necessary fixes for these vulnerabilities.

References