Adobe Commerce Path Traversal Vulnerability Leading to Security Feature Bypass

A path traversal vulnerability allowing improper limitation of a pathname to a restricted directory has been identified in Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier. This vulnerability could be exploited by an unauthenticated attacker to modify files stored outside the restricted directory, potentially leading to a bypass of security features. The exploitation of this vulnerability does not require any user interaction.

Impact

Exploitation of this vulnerability could result in unauthorized modification of files outside the restricted directory, bypassing security features.