CVE-2026-76152 | Apache OFBiz up to 24.09.07 imageCrop/imageRotate productId/imageName path traversal

A vulnerability was found in Apache OFBiz up to 24.09.07. It has been declared as critical. This affects the function imageCrop/imageRotate. The manipulation of the argument productId/imageName results in path traversal.

This vulnerability is reported as CVE-2026-76152. The attack can be launched remotely. No exploit exists.

It is recommended to upgrade the affected component.VulDB Recent EntriesRead More