CVE-2026-66903 · Runtime
NO FIX YET · SEE WHAT TO DO
Apache OFBiz lets an logged-in user use the catalog image management feature to write image files to paths outside the intended directory. An attacker with an account could place files where the application can reach them, possibly leading to code execution depending on the server layout.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams running Apache OFBiz before 24.09.08 where users can log in and use catalog image management. The sources do not say whether default configurations are exposed or what the exact write impact is. Installations on a supported later version, or with no authenticated users who can reach catalog image management, are less exposed.
Not affected if no-authenticated-users, version-24.09.08-or-later
Who cares apache-ofbiz, java, self-hosted
24.09.08 are affected.24.09.08Authenticated Path Traversal in Catalog Image Management allows writing image files outside the intended directory in Apache OFBiz.
This issue affects Apache OFBiz: before 24.09.08.
Users are recommended to upgrade to version 24.09.08, which fixes the issue.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.