CVE Feed

    Dashboard / CVE / CVE-2026-76152

    CVE-2026-76152

    Path traversal and missing authorization check in the imageCrop and imageRotate services in Apache OFBiz through 24.09.07 on all platforms allows a remote authenticated attacker with only Catalog view permission to read arbitrary image-parseable files readable by the OFBiz process, disclosed via re-encoded and republished product content, and to write a re-encoded image to an arbitrary directory writable by the OFBiz process via crafted productId and imageName parameters. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

    Published:Nov 5, 2026
    Last Modified:Nov 5, 2026
    EPS:Nov 5, 2026
    EPSS Score:
    CVSS Score:

    Affected Products

    Vendor
    Apache
    Product
    Ofbiz
    Vendor
    Apache Software Foundation
    Product
    Apache Ofbiz

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-66903 — Authenticated Path Traversal in Catalog Image Management allows writing image files outside the intended direc…
    CVE-2026-71901 — Improper Control of Resource Identifiers ('Resource Injection') vulnerability in Apache OFBiz. An authentic…
    CVE-2026-68524 — An unauthenticated attacker can exploit temporary-file handling, access an open file descriptor, and inject a …
    CVE-2026-73578 — Missing authorization enforcement in RequestHandler.renderView in Apache OFBiz 24.09 before 24.09.08 on all pl…
    CVE-2026-73580 — Missing authorization check in the getHRChild service in Apache OFBiz through 24.09.07 on all platforms allows…
    CVE-2026-74841 — In multitenant deployments, ContextFilter and LoginWorker built a per-tenant delegator name from a request-sup…
    CVE-2026-76150 — Path traversal and missing authorization check in the replaceImageToExistImage service in Apache OFBiz through…
    CVE-2026-81734 — Missing Authorization in ProductEvents in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote …
    CVE-2026-81744 — Incorrect Authorization in ContentPermissionServices in Apache OFBiz 24.09 before 24.09.08 on all platforms al…
    CVE-2026-81808 — Missing Authorization in ProductSearchEvents in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a r…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High