{"id":"CVE-2026-76152","kind":"vulnerability","aliases":["CVE-2026-76152"],"related":[],"title":"Apache OFBiz: image crop and rotate services expose file reads and writes","description":"Path traversal and missing authorization check in the imageCrop and imageRotate services in Apache OFBiz through 24.09.07 on all platforms allows a remote authenticated attacker with only Catalog view permission to read arbitrary image-parseable files readable by the OFBiz process, disclosed via re-encoded and republished product content, and to write a re-encoded image to an arbitrary directory writable by the OFBiz process via crafted productId and imageName parameters. Users are recommended to upgrade to version 24.09.08, which fixes this issue.","summary":"Apache OFBiz's imageCrop and imageRotate services fail to check paths and authorization, so a logged-in user with only Catalog view permission can read image-parseable files the OFBiz process can access. The same flaw lets that user write a re-encoded image to an arbitrary directory the OFBiz process can write to.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-ofbiz","erp","runtime","self-hosted"],"not_affected_if":["no-catalog-view-users","version-24.09.08-or-later"],"how_to_check":"- Check the installed OFBiz version and see whether it is `24.09.07` or earlier, for example by looking at the release directory or `ofbiz.jar` version.\n- Review whether accounts with only Catalog view permission can reach the imageCrop and imageRotate services.","fix":"- Apache OFBiz: upgrade to `24.09.08`","status":"open","published_at":"2026-11-05T15:17:23+00:00","first_seen_at":"2026-11-05T15:39:22+00:00","triaged_at":"2026-11-05T15:40:54+00:00","updated_at":"2026-11-05T15:40:54+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-05T15:40:54Z","model":"claude-haiku-5-5","output":{"fix":"- Apache OFBiz: upgrade to `24.09.08`","reach":"network","title":"Apache OFBiz: image crop and rotate services expose file reads and writes","impact":"medium","summary":"Apache OFBiz's imageCrop and imageRotate services fail to check paths and authorization, so a logged-in user with only Catalog view permission can read image-parseable files the OFBiz process can access. The same flaw lets that user write a re-encoded image to an arbitrary directory the OFBiz process can write to.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["apache-ofbiz","self-hosted","erp"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"authenticated user reads or writes arbitrary files on server","analyst_note":"","how_to_check":"- Check the installed OFBiz version and see whether it is `24.09.07` or earlier, for example by looking at the release directory or `ofbiz.jar` version.\n- Review whether accounts with only Catalog view permission can reach the imageCrop and imageRotate services.","plain_action":"","needs_analyst":false,"not_affected_if":["version-24.09.08-or-later","no-catalog-view-users"],"who_is_affected":"Teams running Apache OFBiz through 24.09.07 on any platform, especially where users with Catalog view permission can log in. The issue is in the image crop and rotate services, so deployments that do not expose them to such users face less risk. Teams on 24.09.08 or later are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000716,"input_tokens":4297,"output_tokens":573,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-76152':15A,18A '24.09.07':99C '24.09.08':164C 'access':61B 'allow':103C 'apach':1A,20B,27B,96C 'apache-ofbiz':19B 'arbitrari':76B,115C,144C 'attack':107C 'authent':106C 'author':39B,87C 'catalog':48B,110C 'check':36B,88C 'content':133C 'craft':152C 'crop':4A 'cve':13A,16A 'directori':77B,145C 'disclos':125C 'encod':72B,129C,140C 'erp':22B 'expos':8A 'fail':34B 'file':9A,56B,119C 'fix':166C 'flaw':64B 'host':26B 'imag':3A,54B,73B,117C,141C 'image-pars':53B,116C 'imagecrop':30B,91C 'imagenam':155C 'imagerot':32B,93C 'issu':168C 'let':65B 'log':43B 'logged-in':42B 'miss':86C 'ofbiz':2A,21B,28B,58B,79B,97C,123C,149C 'paramet':156C 'parseabl':55B,118C 'path':37B,83C 'permiss':50B,112C 'platform':102C 'process':59B,80B,124C,150C 'product':132C 'productid':153C 're':71B,128C,139C 're-encod':70B,127C,138C 'read':10A,52B,114C 'readabl':120C 'recommend':159C 'remot':105C 'republish':131C 'rotat':6A 'runtim':23B 'self':25B 'self-host':24B 'servic':7A,33B,94C 'travers':84C 'upgrad':161C 'user':45B,67B,157C 'version':163C 'via':126C,151C 'view':49B,111C 'writabl':146C 'write':12A,68B,82B,136C","nicknames":[],"mitigations":[],"who_affected":"Teams running Apache OFBiz through 24.09.07 on any platform, especially where users with Catalog view permission can log in. The issue is in the image crop and rotate services, so deployments that do not expose them to such users face less risk. Teams on 24.09.08 or later are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["apacheofbiz","erp","runtime","selfhosted","unknown"],"campaign_type":null,"first_public_at":"2026-11-05T15:17:23+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-76152","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76152","severity":null,"published_at":"2026-11-05T15:17:23+00:00","modified_at":"2026-11-05T15:17:23+00:00","first_seen_at":"2026-11-05T15:39:22+00:00","fetched_at":"2026-11-05T15:39:22+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}