Apache OFBiz 24.09.08 patches multiple critical vulnerabilities
Original title: Apache OFBiz: CVE Announcements
Multiple critical issues in Apache OFBiz before 24.09.08 have been fixed by upgrading to 24.09.08.
Multiple security vulnerabilities have been identified in Apache OFBiz, including some critical issues. Users are advised to upgrade to Apache OFBiz 24.09.08 to address these vulnerabilities. The vulnerabilities are CVE-2026-66903: Authenticated Path Traversal in Catalog Image Management and CVE-2026-68524: Pre-Authentication Remote Code Execution via Attacker-Controlled Screen.
Unconfirmed: The text does not specify if exploitation has occurred.
- Upgrade to Apache OFBiz 24.09.08
- Vulnerabilities include authenticated path traversal and pre-auth RCE
- All versions prior to 24.09.08 affected
Impact: Authenticated path traversal and remote code execution
- 1.Upgrade to Apache OFBiz 24.09.08
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-66903 | Authenticated path traversal in Apache OFBiz catalog images | 6.5 | — | ||
| CVE-2026-68524 | Unauthenticated Screen injection in Apache OFBiz before 24.09.08 | 7.5 | — |
From the original article
Posted by Jacopo Cappellato on Nov 04 Multiple security vulnerabilities have been identified in Apache OFBiz, including some critical issues. Affected versions: All versions prior to 24. 09.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.