Adobe Commerce Unrestricted File Upload Vulnerability Allowing Arbitrary Code Execution

A vulnerability allowing unrestricted file uploads of dangerous types has been identified in Adobe Commerce. This issue could lead to arbitrary code execution in the context of the current user. An attacker might exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploitation requires user interaction, as a victim must visit a maliciously crafted URL or engage with a compromised web page.

Impact

Successful exploitation could result in arbitrary code execution, allowing an attacker to execute malicious scripts on the affected system.

Remediation

Users are advised to update to the latest versions of Adobe Commerce. Instructions for updating can be found in the Adobe Security Bulletin APSB26-73.