CVE-2026-66903

CVSS 6.5 (medium) · published 2026-11-05

Authenticated Path Traversal in Catalog Image Management allows writing image files outside the intended directory in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.08. Users are recommended to upgrade to version 24.09.08, which fixes the issue.

Weakness: CWE-24

Source: NVD CVE-2026-66903

References

• https://lists.apache.org/thread.html/7b2syzksp7klt9fvhdg0olldvs2g83lz

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.