Apache OFBiz 24.09.08 patches multiple critical vulnerabilities
Multiple critical issues in Apache OFBiz before 24.09.08 have been fixed by upgrading to 24.09.08.
85
CVE-2026-66903
Authenticated path traversal in Apache OFBiz catalog images
- CVSS 3.1
- 6.5 medium
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Apache OFBiz Catalog Image Management has an authenticated path traversal flaw that lets a logged-in user write image files outside the intended directory. An attacker who already has an account can trigger it through catalog image handling; no other interaction is described. Users of Apache OFBiz before 24.09.08 are affected.
What to do: Upgrade Apache OFBiz to 24.09.08, which fixes the issue.
| Product | Affected | Fixed in |
|---|---|---|
| Apache OFBiz | before 24.09.08 | 24.09.08 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Authenticated Path Traversal in Catalog Image Management allows writing image files outside the intended directory in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.08. Users are recommended to upgrade to version 24.09.08, which fixes the issue.
- Weakness
- CWE-24
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N