Apache OFBiz versions through 24.09.07 contain a vulnerability in the replaceImageToExistImage service that allows remote authenticated attackers with only Catalog view permission to overwrite arbitrary files writable by the OFBiz process. This is due to a path traversal and missing authorization check, which can be exploited by crafting specific parameters. The issue is fixed in version 24.09.08.