Adobe Commerce and Magento Open Source Path Traversal Vulnerability Allowing Arbitrary File System Access

A path traversal vulnerability has been identified in Adobe Commerce and Magento Open Source versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier. This vulnerability allows authenticated attackers with administrative privileges to read or write files outside of restricted directories, potentially leading to unauthorized file system access. The issue can be exploited without user interaction.

Impact

Exploitation of this vulnerability could result in unauthorized reading or writing of files on the server, potentially leading to further exploitation or data exposure.

Remediation

Users are advised to update to Adobe Commerce versions 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, 2.4.4-p18 or to Magento Open Source versions 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15.