CVE-2026-76150 · Runtime
NO FIX YET · SEE WHAT TO DO
A flaw in the replaceImageToExistImage service lets a logged-in user with only Catalog view permission overwrite any file the OFBiz process can write, using crafted product and data resource parameters. The overwritten content is JPEG-encoded data chosen by the attacker.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Any deployment of Apache OFBiz through 24.09.07 on any platform where users hold Catalog view permission. The attack needs a valid account with that permission, so deployments without authenticated users in the Catalog area are less exposed.
Not affected if no-catalog-permission-users, version-24.09.08-or-later
Who cares apache-ofbiz, erp, java, self-hosted
24.09.07 or earlier.24.09.08, which the advisory says fixes this issue.Path traversal and missing authorization check in the replaceImageToExistImage service in Apache OFBiz through 24.09.07 on all platforms allows a remote authenticated attacker with only Catalog view permission to overwrite arbitrary files writable by the OFBiz process with JPEG-encoded content via crafted productId, dataResourceNameExist, and dataResourceNameReplace parameters. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.