---
id: "CVE-2026-66903"
kind: "vulnerability"
aliases: ["CVE-2026-66903"]
title: "Apache OFBiz: catalog image upload path traversal writes files outside directory"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["apache-ofbiz", "java", "runtime", "self-hosted"]
not_affected_if: ["no-authenticated-users", "version-24.09.08-or-later"]
published_at: "2026-11-05T15:17:21+00:00"
first_seen_at: "2026-11-05T15:39:21+00:00"
updated_at: "2026-11-05T15:41:03+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-66903", "first_seen_at": "2026-11-05T15:39:21+00:00"}]
exploit_sources: []
---

# Apache OFBiz: catalog image upload path traversal writes files outside directory

Apache OFBiz lets an logged-in user use the catalog image management feature to write image files to paths outside the intended directory. An attacker with an account could place files where the application can reach them, possibly leading to code execution depending on the server layout.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Apache OFBiz version in use; the sources say versions before `24.09.08` are affected.
- Confirm whether catalog image management is enabled for users who are not administrators.

## Fix

- Apache OFBiz: upgrade to `24.09.08`

## Timeline

- 2026-11-05T15:39:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-66903

## From the sources

Authenticated Path Traversal in Catalog Image Management allows writing image files outside the intended directory in Apache OFBiz.



This issue affects Apache OFBiz: before 24.09.08.



Users are recommended to upgrade to version 24.09.08, which fixes the issue.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_