{"id":"CVE-2026-76150","kind":"vulnerability","aliases":["CVE-2026-76150"],"related":[],"title":"Apache OFBiz: catalog users can overwrite arbitrary server files via image upload","description":"Path traversal and missing authorization check in the replaceImageToExistImage service in Apache OFBiz through 24.09.07 on all platforms allows a remote authenticated attacker with only Catalog view permission to overwrite arbitrary files writable by the OFBiz process with JPEG-encoded content via crafted productId, dataResourceNameExist, and dataResourceNameReplace parameters. Users are recommended to upgrade to version 24.09.08, which fixes this issue.","summary":"A flaw in the replaceImageToExistImage service lets a logged-in user with only Catalog view permission overwrite any file the OFBiz process can write, using crafted product and data resource parameters. The overwritten content is JPEG-encoded data chosen by the attacker.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-ofbiz","erp","java","runtime","self-hosted"],"not_affected_if":["no-catalog-permission-users","version-24.09.08-or-later"],"how_to_check":"- Check the installed OFBiz version and whether it is `24.09.07` or earlier.\n- Confirm whether the Catalog application is reachable by users with only view permission.","fix":"- Upgrade Apache OFBiz to `24.09.08`, which the advisory says fixes this issue.","status":"open","published_at":"2026-11-05T15:17:22+00:00","first_seen_at":"2026-11-05T15:39:22+00:00","triaged_at":"2026-11-05T15:40:55+00:00","updated_at":"2026-11-05T15:40:55+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-05T15:40:55Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Apache OFBiz to `24.09.08`, which the advisory says fixes this issue.","reach":"network","title":"Apache OFBiz: catalog users can overwrite arbitrary server files via image upload","impact":"high","summary":"A flaw in the replaceImageToExistImage service lets a logged-in user with only Catalog view permission overwrite any file the OFBiz process can write, using crafted product and data resource parameters. The overwritten content is JPEG-encoded data chosen by the attacker.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["apache-ofbiz","java","self-hosted","erp"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"attacker overwrites server files, possibly leading to code execution","analyst_note":"","how_to_check":"- Check the installed OFBiz version and whether it is `24.09.07` or earlier.\n- Confirm whether the Catalog application is reachable by users with only view permission.","plain_action":"","needs_analyst":false,"not_affected_if":["version-24.09.08-or-later","no-catalog-permission-users"],"who_is_affected":"Any deployment of Apache OFBiz through 24.09.07 on any platform where users hold Catalog view permission. The attack needs a valid account with that permission, so deployments without authenticated users in the Catalog area are less exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000691,"input_tokens":4275,"output_tokens":527,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-76150':15A,18A '24.09.07':86C '24.09.08':128C 'allow':90C 'apach':1A,20B,83C 'apache-ofbiz':19B 'arbitrari':7A,102C 'attack':71B,94C 'authent':93C 'author':76C 'catalog':3A,42B,97C 'check':77C 'chosen':68B 'content':62B,113C 'craft':54B,115C 'cve':13A,16A 'data':57B,67B 'dataresourcenameexist':117C 'dataresourcenamereplac':119C 'encod':66B,112C 'erp':22B 'file':9A,47B,103C 'fix':130C 'flaw':29B 'host':27B 'imag':11A 'issu':132C 'java':23B 'jpeg':65B,111C 'jpeg-encod':64B,110C 'let':34B 'log':37B 'logged-in':36B 'miss':75C 'ofbiz':2A,21B,49B,84C,107C 'overwrit':6A,45B,101C 'overwritten':61B 'paramet':59B,120C 'path':72C 'permiss':44B,99C 'platform':89C 'process':50B,108C 'product':55B 'productid':116C 'recommend':123C 'remot':92C 'replaceimagetoexistimag':32B,80C 'resourc':58B 'runtim':24B 'self':26B 'self-host':25B 'server':8A 'servic':33B,81C 'travers':73C 'upgrad':125C 'upload':12A 'use':53B 'user':4A,39B,121C 'version':127C 'via':10A,114C 'view':43B,98C 'writabl':104C 'write':52B","nicknames":[],"mitigations":[],"who_affected":"Any deployment of Apache OFBiz through 24.09.07 on any platform where users hold Catalog view permission. The attack needs a valid account with that permission, so deployments without authenticated users in the Catalog area are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apacheofbiz","erp","high","java","runtime","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-05T15:17:22+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-76150","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76150","severity":null,"published_at":"2026-11-05T15:17:22+00:00","modified_at":"2026-11-05T15:17:22+00:00","first_seen_at":"2026-11-05T15:39:22+00:00","fetched_at":"2026-11-05T15:39:22+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}