CVE-2026-66903Apache OFBiz: Authenticated Path Traversal in Catalog Image Management

Authenticated Path Traversal in Catalog Image Management allows writing image files outside the intended directory in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.08. Users are recommended to upgrade to version 24.09.08, which fixes the issue.

6.5 MEDIUMEPSS 0.44%Not in KEVNVD: Awaiting Analysis

Last updated: 2026-11-06 21:36 UTC

Overview Affected Products References

NVD CVE.org

Overview

Severity

Score	Severity	Version	Vector String
6.5	MEDIUM	3.1CISA-ADP	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Details

CVE ID: CVE-2026-66903
Status: Awaiting Analysis
Assigner (CNA): apache
Published: Nov 5, 2026
Last modified: 2026-11-06 21:36 UTC
Weaknesses: CWE-24 · Path Traversal: '../filedir'

Sources

NVD
CVE.org
CISA KEV
FIRST EPSS

Refreshed hourly from the sources above. Last fetched 2026-11-08 08:16 UTC.