A path traversal flaw combined with a missing authorization check in the replaceImageToExistImage service allows a remote authenticated attacker who only has Catalog view permission to write arbitrary JPEG-encoded data to any file that is writable by the OFBiz process. The attacker can craft productId, dataResourceNameExist, and dataResourceNameReplace parameters to target the location of the overwrite, resulting in arbitrary file modification or replacement on the server.

The vulnerability affects Apache Software Foundation’s Apache OFBiz software through version 24.09.07 on all supported platforms. Any deployment of those versions that allows the replaceImageToExistImage service to access writable files is potentially impacted.

The issue is not listed in the CISA KEV catalog and no EPSS score is available, indicating no documented exploitation to date. However, the flaw requires only local Catalog view rights and any attacker who can authenticate to OFBiz can exploit it. Because the vulnerability permits overwriting files, it poses a high risk for confidentiality, integrity, and availability of the affected system. An attacker could replace critical application files, inject malicious code, or perform other destructive actions once authenticated.