{"id":"CVE-2026-66903","kind":"vulnerability","aliases":["CVE-2026-66903"],"related":[],"title":"Apache OFBiz: catalog image upload path traversal writes files outside directory","description":"Authenticated Path Traversal in Catalog Image Management allows writing image files outside the intended directory in Apache OFBiz.\n\n\n\nThis issue affects Apache OFBiz: before 24.09.08.\n\n\n\nUsers are recommended to upgrade to version 24.09.08, which fixes the issue.","summary":"Apache OFBiz lets an logged-in user use the catalog image management feature to write image files to paths outside the intended directory. An attacker with an account could place files where the application can reach them, possibly leading to code execution depending on the server layout.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-ofbiz","java","runtime","self-hosted"],"not_affected_if":["no-authenticated-users","version-24.09.08-or-later"],"how_to_check":"- Check the Apache OFBiz version in use; the sources say versions before `24.09.08` are affected.\n- Confirm whether catalog image management is enabled for users who are not administrators.","fix":"- Apache OFBiz: upgrade to `24.09.08`","status":"open","published_at":"2026-11-05T15:17:21+00:00","first_seen_at":"2026-11-05T15:39:21+00:00","triaged_at":"2026-11-05T15:41:03+00:00","updated_at":"2026-11-05T15:41:03+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-05T15:41:03Z","model":"claude-haiku-5-5","output":{"fix":"- Apache OFBiz: upgrade to `24.09.08`","reach":"internet","title":"Apache OFBiz: catalog image upload path traversal writes files outside directory","impact":"high","summary":"Apache OFBiz lets an logged-in user use the catalog image management feature to write image files to paths outside the intended directory. An attacker with an account could place files where the application can reach them, possibly leading to code execution depending on the server layout.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["apache-ofbiz","self-hosted","java"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"authenticated user writes files outside intended directory on server","analyst_note":"Check the Apache OFBiz security advisory for the exact impact and whether default configurations are affected.","how_to_check":"- Check the Apache OFBiz version in use; the sources say versions before `24.09.08` are affected.\n- Confirm whether catalog image management is enabled for users who are not administrators.","plain_action":"","needs_analyst":true,"not_affected_if":["version-24.09.08-or-later","no-authenticated-users"],"who_is_affected":"Teams running Apache OFBiz before 24.09.08 where users can log in and use catalog image management. The sources do not say whether default configurations are exposed or what the exact write impact is. Installations on a supported later version, or with no authenticated users who can reach catalog image management, are less exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000694,"input_tokens":4209,"output_tokens":547,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-66903':14A,17A '24.09.08':98C,106C 'account':54B 'affect':94C 'allow':81C 'apach':1A,19B,26B,90C,95C 'apache-ofbiz':18B 'applic':60B 'attack':51B 'authent':74C 'catalog':3A,36B,78C 'code':67B 'could':55B 'cve':12A,15A 'depend':69B 'directori':11A,49B,88C 'execut':68B 'featur':39B 'file':9A,43B,57B,84C 'fix':108C 'host':25B 'imag':4A,37B,42B,79C,83C 'intend':48B,87C 'issu':93C,110C 'java':21B 'layout':73B 'lead':65B 'let':28B 'log':31B 'logged-in':30B 'manag':38B,80C 'ofbiz':2A,20B,27B,91C,96C 'outsid':10A,46B,85C 'path':6A,45B,75C 'place':56B 'possibl':64B 'reach':62B 'recommend':101C 'runtim':22B 'self':24B 'self-host':23B 'server':72B 'travers':7A,76C 'upgrad':103C 'upload':5A 'use':34B 'user':33B,99C 'version':105C 'write':8A,41B,82C","nicknames":[],"mitigations":[],"who_affected":"Teams running Apache OFBiz before 24.09.08 where users can log in and use catalog image management. The sources do not say whether default configurations are exposed or what the exact write impact is. Installations on a supported later version, or with no authenticated users who can reach catalog image management, are less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apacheofbiz","java","runtime","selfhosted","unknown"],"campaign_type":null,"first_public_at":"2026-11-05T15:17:21+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-66903","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-66903","severity":null,"published_at":"2026-11-05T15:17:21+00:00","modified_at":"2026-11-05T15:17:21+00:00","first_seen_at":"2026-11-05T15:39:21+00:00","fetched_at":"2026-11-05T15:39:21+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}