CVE-2026-76150

INFO Priority: 0.00 BB Relevance: 0/100

Published: 2026-11-05 Modified: 2026-11-06 First seen: 2026-11-05 Status: pending_score

Description

Path traversal and missing authorization check in the replaceImageToExistImage service in Apache OFBiz through 24.09.07 on all platforms allows a remote authenticated attacker with only Catalog view permission to overwrite arbitrary files writable by the OFBiz process with JPEG-encoded content via crafted productId, dataResourceNameExist, and dataResourceNameReplace parameters. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

Weakness Classification (2)

CWE-22 — CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-862 — CWE-862 Missing Authorization

Affected Software (1)

Vendor	Product	Version
Apache Software Foundation	Apache OFBiz	0 < 24.09.08

References & Advisories (1)

https://lists.apache.org/thread.html/7b2syzksp7klt9fvhdg0olldvs2g83lz

vendor-advisory

Bug Bounty Relevance

0 / 100

CVSS Score

Unscored

EPSS — Exploitation Probability

0.21%

Raw Score 0.002070

Percentile 10.8%

Date 2026-11-07

EPSS Trend

2026-11-07

0.00207

2026-11-06

0.00207

Intelligence Sources

mitre ref →

nvd ref →

External Links

NVD (NIST) CVE Details FIRST EPSS API OSV.dev