{"id":"CVE-2026-76150","aliases":["EUVD-2026-117488","GHSA-mvr7-jm24-r3fm"],"status":"published","title":"Apache OFBiz: Authenticated path traversal and missing authorization check in replaceImageToExistImage","description":"Path traversal and missing authorization check in the replaceImageToExistImage service in Apache OFBiz through 24.09.07 on all platforms allows a remote authenticated attacker with only Catalog view permission to overwrite arbitrary files writable by the OFBiz process with JPEG-encoded content via crafted productId, dataResourceNameExist, and dataResourceNameReplace parameters. Users are recommended to upgrade to version 24.09.08, which fixes this issue.","epss":{"day":"2026-11-09","score":0.00207,"percentile":0.10802,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-22","CWE-862"],"published":"2026-11-05T14:09:10Z","modified":"2026-11-05T15:34:17Z","products":[{"vendor":"apache software foundation","product":"apache ofbiz"}],"references":[{"url":"https://lists.apache.org/thread.html/7b2syzksp7klt9fvhdg0olldvs2g83lz","tags":["vendor-advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76150"},{"url":"https://github.com/advisories/GHSA-mvr7-jm24-r3fm"}],"sources":{"cve":[{"id":"CVE-2026-76150","title":"Apache OFBiz: Authenticated path traversal and missing authorization check in replaceImageToExistImage","description":"Path traversal and missing authorization check in the replaceImageToExistImage service in Apache OFBiz through 24.09.07 on all platforms allows a remote authenticated attacker with only Catalog view permission to overwrite arbitrary files writable by the OFBiz process with JPEG-encoded content via crafted productId, dataResourceNameExist, and dataResourceNameReplace parameters. Users are recommended to upgrade to version 24.09.08, which fixes this issue.","status":"published","published":"2026-11-05T14:09:10.633Z","modified":"2026-11-05T14:09:10.633Z","cwes":["CWE-22","CWE-862"],"updated_at":"2026-11-05T16:36:34.343037Z"}],"euvd":[{"id":"EUVD-2026-117488","description":"Path traversal and missing authorization check in the replaceImageToExistImage service in Apache OFBiz through 24.09.07 on all platforms allows a remote authenticated attacker with only Catalog view permission to overwrite arbitrary files writable by the OFBiz process with JPEG-encoded content via crafted productId, dataResourceNameExist, and dataResourceNameReplace parameters. Users are recommended to upgrade to version 24.09.08, which fixes this issue.","status":"published","published":"2026-11-05T14:09:10Z","modified":"2026-11-05T14:09:10Z","updated_at":"2026-11-05T18:01:00.39688Z"}],"ghsa":[{"id":"GHSA-mvr7-jm24-r3fm","title":"Path traversal and missing authorization check in the replaceImageToExistImage service in Apache...","description":"Path traversal and missing authorization check in the replaceImageToExistImage service in Apache OFBiz through 24.09.07 on all platforms allows a remote authenticated attacker with only Catalog view permission to overwrite arbitrary files writable by the OFBiz process with JPEG-encoded content via crafted productId, dataResourceNameExist, and dataResourceNameReplace parameters. Users are recommended to upgrade to version 24.09.08, which fixes this issue.","status":"published","published":"2026-11-05T15:32:38Z","modified":"2026-11-05T15:34:17Z","cwes":["CWE-22"],"updated_at":"2026-11-05T16:36:50.741706Z"}],"nvd":[{"id":"CVE-2026-76150","description":"Path traversal and missing authorization check in the replaceImageToExistImage service in Apache OFBiz through 24.09.07 on all platforms allows a remote authenticated attacker with only Catalog view permission to overwrite arbitrary files writable by the OFBiz process with JPEG-encoded content via crafted productId, dataResourceNameExist, and dataResourceNameReplace parameters. Users are recommended to upgrade to version 24.09.08, which fixes this issue.","status":"published","published":"2026-11-05T15:17:22.883Z","modified":"2026-11-06T21:36:32.997Z","cwes":["CWE-22","CWE-862"],"updated_at":"2026-11-07T00:02:36.318174Z"}]}}