{"id":"CVE-2026-66903","aliases":["EUVD-2026-117496","GHSA-hjm8-7374-p77g"],"status":"published","title":"Apache OFBiz: Authenticated Path Traversal in Catalog Image Management","description":"Authenticated Path Traversal in Catalog Image Management allows writing image files outside the intended directory in Apache OFBiz.\n\n\n\nThis issue affects Apache OFBiz: before 24.09.08.\n\n\n\nUsers are recommended to upgrade to version 24.09.08, which fixes the issue.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00443,"percentile":0.388,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-24"],"published":"2026-11-05T14:12:30Z","modified":"2026-11-05T21:28:14Z","products":[{"vendor":"apache software foundation","product":"apache ofbiz"}],"references":[{"url":"https://lists.apache.org/thread.html/7b2syzksp7klt9fvhdg0olldvs2g83lz","tags":["vendor-advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-66903"},{"url":"https://github.com/advisories/GHSA-hjm8-7374-p77g"}],"sources":{"cve":[{"id":"CVE-2026-66903","title":"Apache OFBiz: Authenticated Path Traversal in Catalog Image Management","description":"Authenticated Path Traversal in Catalog Image Management allows writing image files outside the intended directory in Apache OFBiz.\n\n\n\nThis issue affects Apache OFBiz: before 24.09.08.\n\n\n\nUsers are recommended to upgrade to version 24.09.08, which fixes the issue.","status":"published","published":"2026-11-05T14:12:30.649Z","modified":"2026-11-05T21:28:14.646Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-24"],"updated_at":"2026-11-05T22:55:20.139479Z"}],"euvd":[{"id":"EUVD-2026-117496","description":"Authenticated Path Traversal in Catalog Image Management allows writing image files outside the intended directory in Apache OFBiz.\n\n\n\nThis issue affects Apache OFBiz: before 24.09.08.\n\n\n\nUsers are recommended to upgrade to version 24.09.08, which fixes the issue.","status":"published","published":"2026-11-05T14:12:30Z","modified":"2026-11-05T21:28:14Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-05T22:02:07.885196Z"}],"ghsa":[{"id":"GHSA-hjm8-7374-p77g","title":"Authenticated Path Traversal in Catalog Image Management allows writing image files outside the...","description":"Authenticated Path Traversal in Catalog Image Management allows writing image files outside the intended directory in Apache OFBiz.\n\n\n\nThis issue affects Apache OFBiz: before 24.09.08.\n\n\n\nUsers are recommended to upgrade to version 24.09.08, which fixes the issue.","status":"published","published":"2026-11-05T15:32:38Z","modified":"2026-11-06T00:33:45Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-24"],"updated_at":"2026-11-06T00:57:25.690752Z"}],"nvd":[{"id":"CVE-2026-66903","description":"Authenticated Path Traversal in Catalog Image Management allows writing image files outside the intended directory in Apache OFBiz.\n\n\n\nThis issue affects Apache OFBiz: before 24.09.08.\n\n\n\nUsers are recommended to upgrade to version 24.09.08, which fixes the issue.","status":"published","published":"2026-11-05T15:17:21.96Z","modified":"2026-11-06T21:36:32.997Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-24"],"updated_at":"2026-11-07T00:02:36.318174Z"}]}}