EUVD-2026-117496
GHSA-hjm8-7374-p77g
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to OFBiz catalog UI
-
ExploitSubmit crafted path in image management request
-
ExecutionTraverse outside intended catalog directory
-
ImpactRead or write arbitrary server files
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path traversal prevention
|
| Exploitation Conditions | Exploitation requires access to the Apache OFBiz Catalog Image Management functionality, which per the vendor-assigned title is an authenticated operation - so a valid account with access to catalog image handling is the stated prerequisite. This limits realistic risk to attackers who can already log in (or who chain one of the batch's unauthenticated flaws to obtain a session). The specific vulnerable parameter and whether the traversal enables arbitrary file read, write, or both is not described in the available sources. Affects all OFBiz versions prior to 24.09.08; upgrading to 24.09.08 is the vendor-stated remediation. |
| Impact | This is one of 44 vulnerabilities disclosed together in the Apache OFBiz 24.09.08 batch advisory, and the available signals for CVE-2026-66903 specifically are thin. No CVSS vector, EPSS score, or SSVC technical-impact data is provided (all shown as N/A), the CISA KEV status is not indicated, and the vuln.today decision label is explicitly 'awaiting_data' - meaning the usual prioritization signals have not yet been populated. On its own, this issue is described by the vendor title as an *authenticated* path traversal in catalog image management, which structurally places it well below the critical pre-authentication items bundled in the same announcement (notably CVE-2026-68524 pre-auth RCE, CVE-2026-83542 unauth RCE, and CVE-2026-105330 hard-coded JWT key enabling unauth admin access). Because no CVSS vector is supplied, the privilege level cannot be independently confirmed from machine-readable data - the 'authenticated' qualifier comes only from the human-readable CVE title, so treat the authentication requirement as vendor-asserted but not CVSS-confirmed. Realistic priority: moderate and dependent on the batch as a whole - the correct operational action is to apply the single fix (24.09.08) that resolves all 44 issues, driven by the critical unauthenticated RCEs in the set rather than by this specific traversal bug. Missing data to resolve: no official CVSS vector, no EPSS, no confirmed KEV entry, and no description of the actual trigger for this CVE. |
| Exploit ScenarioDerived | An attacker who already holds a valid OFBiz account with access to catalog image management submits a crafted file path containing directory-traversal sequences through the image-management function, causing OFBiz to resolve the path outside its intended catalog media directory. Depending on whether the affected operation reads or writes the file (not specified in the available sources), this could disclose or tamper with files on the server filesystem. No public exploit identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 04, 2026
CVE-2026-66903 is an authenticated path traversal in Apache OFBiz's Catalog Image Management functionality, affecting all versions prior to 24.09.08. An attacker holding a valid account with access to catalog image handling can supply path input that escapes the intended directory, yielding high confidentiality impact with limited integrity impact (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N). The flaw was published as one of 44 CVEs in a single OFBiz batch advisory; no public exploit code or CISA KEV entry has been identified for this specific CVE, and the vulnerable parameter plus whether read, write, or both are achievable is not described in the available sources.
RemediationAI
Upgrade to Apache OFBiz 24.09.08, the vendor-stated fix that addresses this and the other 43 CVEs in the batch. Because the traversal requires an authenticated session with access to Catalog Image Management, a short-term compensating measure is to restrict that catalog image handling permission to accounts that genuinely need it and to review which users hold catalog administration rights, removing access from service, integration and reporting accounts; the trade-off is that legitimate merchandising staff lose the ability to upload or manage images until the upgrade lands. Restricting outbound and filesystem exposure of the OFBiz process (running it under a least-privilege OS account with no read access to unrelated host files) reduces the blast radius of a traversal but does not fix the flaw and carries the side effect that legitimate file-based integrations may break. Note that patching only this CVE is not meaningful here: the same 24.09.08 release closes multiple unauthenticated RCE and authentication-bypass issues that could otherwise be chained to obtain the session this flaw requires, so the upgrade should be treated as a single atomic action. Advisory: https://seclists.org/oss-sec/2026/q4/516 and https://ofbiz.apache.org/.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Apache OFBiz is a Java-based enterprise web framework bundling an entity engine, a service engine and a widget-based UI, widely used for ERP, e-commerce and CRM workloads. Path traversal (the CWE class implied by the vendor title, though no CWE was assigned in the available data) occurs when user-controlled path segments are concatenated into a filesystem path without canonicalization or restriction to a base directory, allowing '../' sequences or absolute paths to resolve outside the intended image store. In this case the entry point is the Catalog Image Management area, a component that handles product/category image upload and serving, and the vendor title explicitly scopes the issue to authenticated users. Because OFBiz runs as a Java servlet container application with filesystem access to its runtime and configuration directories, an escape from the image directory can expose files readable by the OFBiz process; the assessed confidentiality-high/integrity-low vector suggests file disclosure is the primary consequence, but the evidence does not state the exact parameter, the directory boundary, or whether arbitrary writes are possible. The version ceiling matters: the 24.09.08 release is a cumulative hardening drop that also closes pre-authentication RCE, SQL injection, XXE, SSRF, sandbox-escape and hard-coded-credential flaws, so this traversal should be treated as one link in a chain rather than an isolated bug.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Web-reachable catalog feature (AV:N/AC:L); PR:L for the vendor-stated authenticated access; path traversal implies arbitrary file access (C:H) with possible limited file writes (I:L); trigger not detailed.
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
2Description PRE-NVD
Articles & Coverage 1
Executive ViewAI
CVE-2026-66903 is an authenticated path traversal in Apache OFBiz's Catalog Image Management (all versions before 24.09.08). A user with catalog image privileges can read arbitrary files on the server, potentially exposing sensitive data such as configuration files or customer information. While authentication limits broad exploitation, any compromised or malicious account poses a data confidentiality risk to the organization.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict OFBiz access to trusted networks, enforce least privilege for catalog image management, and deploy WAF rules to block path traversal attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Exploit-DB