CVE-20XX-?

CVE-2026-76150

unscored Fix listed Disclosure Web app

What it is

Path traversal and missing authorization check in the replaceImageToExistImage service in Apache OFBiz through 24.09.07 on all platforms allows a remote authenticated attacker with only Catalog view permission to overwrite arbitrary files writable by the OFBiz process with JPEG-encoded content via crafted productId, dataResourceNameExist, and dataResourceNameReplace parameters. Users are recommended to upgrade to version 24.09.08, which fixes this issue.

At a glance

Fix
A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

  1. PublishedDisclosed publicly on CVE.org and NVD
  2. Last updatedMost recent change to the record

Details

Published
Last modified
Weakness
CWE-22 · Path traversal
Record status
Received
Meme: I wake up, CVE-2026-76150
Download Square Reddit

References

NVD record · CVE.org record