A path traversal flaw coupled with a missing authorization check in Apache OFBiz’s imageCrop and imageRotate services allows an authenticated attacker who only possesses Catalog view permission to read any image‑parseable file available to the OFBiz process and to write a re‑encoded image to any directory writable by the process. The attacker can therefore exfiltrate sensitive data or inject malicious content into product representations, compromising confidentiality and integrity of product data. The vulnerability is limited to the image services and does not directly enable execution of arbitrary code, but the ability to read and manipulate files creates a significant risk for organizations relying on OFBiz for product catalog management.

Apache Software Foundation’s Apache OFBiz is vulnerable in all releases through and including version 24.09.07 on every supported platform. Users of these versions should check the exact build identifier to confirm presence of the flaw and plan for remediation accordingly.

The flaw is exploitable by a remote authenticated user with only Catalog view access, a permission commonly granted to many internal accounts. Attackers need only send crafted requests to the imageCrop or imageRotate endpoints, supplying a malicious productId and imageName that reference a target file or directory. While the EPSS score is not available, the lack of a KEV listing does not diminish the potential for misuse; the impact level is high because it permits arbitrary file read and write. The primary attack vector is remote authentication, and the vulnerability can be triggered over HTTP(s) without additional network exposure. Organizations should treat this issue as a substantial security risk, especially for systems exposed to external services or third‑party content publishing.