CVE-2026-76152
Last modified
CVE-2026-76152 is a vulnerability of currently unknown severity. Path traversal and missing authorization check in the imageCrop and imageRotate services in Apache OFBiz through 24.09.07 on all platforms allows a remote authenticated attacker with only Catalog view permission to read arbitrary image-parseable files readable by the OFBiz process, disclosed via re-encoded and republished product content, and to write a re-encoded image to an arbitrary directory writable by the OFBiz process via crafted productId and imageName parameters. Users are recommended to upgrade to version 24.09.08, which fixes this issue.. EPSS estimates a 0.24% chance of exploitation in the next 30 days.
Description
Path traversal and missing authorization check in the imageCrop and imageRotate services in Apache OFBiz through 24.09.07 on all platforms allows a remote authenticated attacker with only Catalog view permission to read arbitrary image-parseable files readable by the OFBiz process, disclosed via re-encoded and republished product content, and to write a re-encoded image to an arbitrary directory writable by the OFBiz process via crafted productId and imageName parameters. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache OFBiz | < 24.09.08 |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2026-76152?
How severe is CVE-2026-76152?
How do I fix CVE-2026-76152?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-76147A path traversal (ZIP Slip) vulnerability caused by insuffic…5.9
- CVE-2026-76148CorvusSKK contains a code injection vulnerability, which may…8.4
- CVE-2026-76149CorvusSKK contains an integer overflow vulnerability, which …4.6
- CVE-2026-7615The Widget Context plugin for WordPress is vulnerable to Cro…4.3
- CVE-2026-76150Path traversal and missing authorization check in the replac…
- CVE-2026-76151Out-of-bounds read (buffer over-read) in the HTTP Cache-Cont…4.6
- CVE-2026-76154A stored cross-site scripting vulnerability in the Geomap pa…7.3
- CVE-2026-76155Use of default credentials in Datiphy Data Management Center…9.3
- CVE-2026-76156OS command injection in the api endpoint of Datiphy Data Man…9.4
- CVE-2026-76157Missing authentication for a critical function in the upload…8.8
- CVE-2026-76158External Control of File Name or Path in the upload API endp…9.3
- CVE-2026-76159Incorrect Permission Assignment for Critical Resource in the…7
Are you affected by CVE-2026-76152?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST