Apache OFBiz CVE-2026-76150

Exploitation requires a valid authenticated session to the Apache OFBiz instance; the vendor describes the replaceImageToExistImage service as lacking an authorization check, so a user without the proper catalog-image permission can still invoke it. The path-traversal component lets an attacker manipulate the target image path/filename to write or replace a file outside the intended catalog image directory. Limiting factors: authentication is mandatory (this is not a pre-auth flaw), and impact is bounded by what the service can write (image file replacement) rather than arbitrary command execution as described. The precise parameter and trigger mechanics are not detailed in the available sources beyond the service name and the 'path traversal + missing authorization' classification.

Key decision signals are largely absent: no CVSS vector, CWE, EPSS score, SSVC data, or KEV entry is provided, and the vuln.today priority is explicitly 'awaiting_data'. The only sources are the oss-security bundle advisory and the Apache OFBiz site, which disclose dozens of OFBiz CVEs at once; this entry (CVE-2026-76150) is one of the lower-severity authenticated issues in that batch. The vendor title describes it as an authenticated path traversal combined with a missing authorization check in the replaceImageToExistImage service, meaning a logged-in user who should not have catalog-image privileges can overwrite image files and escape the intended directory via path traversal. Because authentication is required and the impact is primarily file overwrite rather than direct pre-auth code execution, real-world risk is materially lower than the pre-auth RCE entries in the same advisory (e.g. CVE-2026-68524, CVE-2026-83542). No public exploit is identified at time of analysis, and there is no evidence of active exploitation. This should be remediated via the vendor upgrade but, on available data, is a secondary priority behind the unauthenticated/RCE items patched in the same release - note that CVSS and EPSS are missing, so this severity judgment is inferred from the vendor description, not confirmed by a scored vector.

An attacker with a low-privileged authenticated OFBiz account invokes the replaceImageToExistImage service, which does not perform the expected authorization check, and supplies a filename/path containing directory-traversal sequences. This causes an image upload/replacement to be written outside the intended catalog image directory, letting the attacker overwrite files they should not be able to touch. No public exploit code has been identified at time of analysis.