CVE-2026-76150— Apache OFBiz: Authenticated path traversal and missing authorization check in replaceImageToExistImage
Quick assessment
Affected
Apache Software Foundation Apache OFBiz
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Apache OFBiz 24.09.07 及更早版本（所有平台）中的 服务存在路径遍历漏洞且缺少授权检查。该漏洞允许仅拥有“目录查看”权限的远程认证攻击者，通过构造 、 和 参数，以 JPEG 编码内容覆盖 OFBiz 进程可写的任意文件。建议用户升级至已修复此问题的 24.09.08 版本。
Possible ATT&CK Techniques 2 AI
T1565.001 · Stored Data Manipulation T1203 · Exploitation for Client Execution
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-76150
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache OFBiz: Authenticated path traversal and missing authorization check in replaceImageToExistImage
Source: CVE Program / CVE List V5
Vulnerability Description
Path traversal and missing authorization check in the replaceImageToExistImage service in Apache OFBiz through 24.09.07 on all platforms allows a remote authenticated attacker with only Catalog view permission to overwrite arbitrary files writable by the OFBiz process with JPEG-encoded content via crafted productId, dataResourceNameExist, and dataResourceNameReplace parameters. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache OFBiz | 0 ~ 24.09.08 | - |
|
II. Public POCs for CVE-2026-76150
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-76150
请登录查看更多情报信息。
Other References for CVE-2026-76150 (1)
Same Patch Batch · Apache Software Foundation · 2026-11-05 · 58 CVEs total
| CVE-2026-73098 | 10.0 CRITICAL | Apache Juneau: Unsafe reflection allows attacker-controlled class initialization during pa |
| CVE-2026-73099 | 10.0 CRITICAL | Apache Juneau: Cross-site request forgery via default-enabled content query-parameter body |
| CVE-2026-73100 | 10.0 CRITICAL | Apache Juneau: Sensitive request headers logged in cleartext by the default request logger |
| CVE-2026-73101 | 10.0 CRITICAL | Apache Juneau: Internal exception class and message disclosed via error response header an |
| CVE-2026-73116 | 10.0 CRITICAL | Apache Juneau: REST client forwards credentials to a different origin when following HTTP |
| CVE-2026-73117 | 10.0 CRITICAL | Apache Juneau: Response header CRLF injection and open redirect when applications set head |
| CVE-2026-96677 | 10.0 CRITICAL | Apache Juneau: Cross-site scripting via unescaped request variables in HTML-doc chrome |
| CVE-2026-121489 | 10.0 CRITICAL | Apache Juneau: Path traversal in DirectoryResource allows reading files outside the config |
| CVE-2026-73095 | 8.7 HIGH | Apache Juneau: Denial of service via unbounded memory allocation in parsers and REST reque |
| CVE-2026-103864 | Apache Sling Engine: Request-derived values reach log sinks without CR/LF neutralization | |
| CVE-2026-97356 | Apache OFBiz: Insufficiently Protected Credentials in ViewFile Enable Authentication Bypas | |
| CVE-2026-109856 | Apache OFBiz: Missing Authorization in Financial Account Services Enables Unauthorized Bal | |
| CVE-2026-109837 | Apache OFBiz: Authorization Bypass Through User-Controlled Key in Order Returns Enables Cr | |
| CVE-2026-109129 | Apache OFBiz: Authorization Bypass Through User-Controlled Key in OrderServices Enables Un | |
| CVE-2026-105461 | Apache OFBiz: Missing authorization in updateOrderItems allows view-only users to modify o | |
| CVE-2026-105330 | Apache OFBiz: Use of Hard-coded Cryptographic Key in JWT Token Authentication Enables Unau | |
| CVE-2026-105325 | Apache OFBiz: Missing authorization in payment application services allows view-only users | |
| CVE-2026-100228 | Apache OFBiz: Improper Input Validation in Order Returns Enables Unauthorized Refund Price | |
| CVE-2026-100168 | Apache OFBiz: Missing Authorization vulnerability | |
| CVE-2026-97355 | Apache OFBiz: Hard-coded Credentials in AdminServer Enable Unauthenticated Denial of Servi |
Showing top 20 of 58 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Apache OFBiz
-
CVE-2026-66903
Apache OFBiz: Authenticated Path Traversal in Catalog Image -
CVE-2026-71901
Apache OFBiz: Dispatch arbitrary internal services on SFA co -
CVE-2026-68524
Apache OFBiz: Pre-Authentication Remote Code Execution via A -
CVE-2026-73577
Apache OFBiz: Unauthenticated path-suffix view authorization -
CVE-2026-73578
Apache OFBiz: Unauthenticated saved-view authorization bypas
Same vendor: Apache Software Foundation
-
CVE-2026-66903
Apache OFBiz: Authenticated Path Traversal in Catalog Image -
CVE-2026-71901
Apache OFBiz: Dispatch arbitrary internal services on SFA co -
CVE-2026-68524
Apache OFBiz: Pre-Authentication Remote Code Execution via A -
CVE-2026-73577
Apache OFBiz: Unauthenticated path-suffix view authorization -
CVE-2026-73578
Apache OFBiz: Unauthenticated saved-view authorization bypas
Same weakness: CWE-22
-
CVE-2026-76152
Apache OFBiz: Authenticated path traversal and missing autho -
CVE-2026-104720
Path Traversal in Kobikom Telecommunications' Kobikom -
CVE-2026-121489
Apache Juneau: Path traversal in DirectoryResource allows re -
CVE-2026-116617
Motors <= 1.4.128 - Authenticated (Subscriber+) File Deletio -
CVE-2026-122188
DeepGraphLearning KnowledgeGraphEmbedding Checkpoint Loading