Authenticated users of Apache OFBiz’s Catalog Image Management are able to write image files outside the intended upload directory. This path traversal flaw permits storage of files in arbitrary locations on the server, potentially compromising data integrity and providing a foothold for further exploitation such as running malicious components.

Apache OFBiz versions earlier than 24.09.08 are affected. Any deployment of these versions, regardless of environment, is susceptible if the Catalog Image Management feature is enabled and accessible to authenticated users.

The CVE lacks an EPSS score and is not listed in the CISA KEV catalog, but the exploitation path requires only valid authentication to the web interface and the ability to submit image uploads. Once authenticated, an attacker can craft a payload that places files outside the intended directory, which can lead to arbitrary code execution or disclosure of sensitive data if critical files are overwritten. Given the severity of the impact, the vulnerability poses a significant risk to systems where the Catalog Image Management service is exposed and access is not tightly controlled.