Skip to content
OpenAdvisories
Medium · 6.5 CVE-2026-66903 EUVD-2026-117496GHSA-hjm8-7374-p77g

Apache OFBiz: Authenticated Path Traversal in Catalog Image Management

Published Nov 5, 2026 · Updated Nov 5, 2026 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache OFBiz

Description

Authenticated Path Traversal in Catalog Image Management allows writing image files outside the intended directory in Apache OFBiz.

This issue affects Apache OFBiz: before 24.09.08.

Users are recommended to upgrade to version 24.09.08, which fixes the issue.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache OFBiz < 24.09.08 24.09.08

Advisories 1

References