Adobe Commerce and Magento Open Source Path Traversal Vulnerability Allowing Security Feature Bypass

A path traversal vulnerability has been identified in Adobe Commerce and Magento Open Source, affecting several versions through 2.4.9-alpha3. This vulnerability allows high-privileged attackers to bypass security features and access unauthorized files or directories outside of the intended restricted path. Exploitation does not require user interaction.

Impact

Exploitation of this vulnerability could lead to unauthorized access to files or directories, allowing for potential security feature bypass.

Remediation

Users are advised to update to Adobe Commerce version 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, or 2.4.4-p17. For Magento Open Source, users should update to version 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, or 2.4.5-p16.