Page History

...

• If you intend to upload images for products, because of possible embedded webshells despite the robust OFBiz protection, you should either:
  
  • Restrict to trusted users subdirectories of themes/common-theme/webapp/images/products.
  • Prevent security issues by making these subdirectories non-executable.
  • As recommended by OWASP, a solid solution is to move the products images upload to another domain.
  • More information at https://cheatsheetseries.owasp.org/cheatsheets/File_Upload_Cheat_Sheet.html

...