CVE-2026-76152 · Runtime
NO FIX YET · SEE WHAT TO DO
Apache OFBiz's imageCrop and imageRotate services fail to check paths and authorization, so a logged-in user with only Catalog view permission can read image-parseable files the OFBiz process can access. The same flaw lets that user write a re-encoded image to an arbitrary directory the OFBiz process can write to.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams running Apache OFBiz through 24.09.07 on any platform, especially where users with Catalog view permission can log in. The issue is in the image crop and rotate services, so deployments that do not expose them to such users face less risk. Teams on 24.09.08 or later are not affected.
Not affected if no-catalog-view-users, version-24.09.08-or-later
Who cares apache-ofbiz, erp, self-hosted
24.09.07 or earlier, for example by looking at the release directory or ofbiz.jar version.24.09.08Path traversal and missing authorization check in the imageCrop and imageRotate services in Apache OFBiz through 24.09.07 on all platforms allows a remote authenticated attacker with only Catalog view permission to read arbitrary image-parseable files readable by the OFBiz process, disclosed via re-encoded and republished product content, and to write a re-encoded image to an arbitrary directory writable by the OFBiz process via crafted productId and imageName parameters. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.