Executive brief
Adobe Commerce, a popular e-commerce platform, is affected by a security vulnerability that could allow an administrative user to bypass certain security restrictions. By tricking a victim into visiting a malicious link, an attacker with high-level privileges could gain unauthorized write access to the file system. While this requires significant existing access and user interaction, it could lead to unauthorized modifications of the store's underlying files.
Technical details
An improper input validation vulnerability (CWE-20) exists in Adobe Commerce versions up to 2.4.9-beta1. The flaw allows a high-privileged attacker to bypass security features, potentially leading to arbitrary file system writes. Exploitation requires the attacker to have network access and high-level administrative privileges, and further requires a victim to interact with a maliciously crafted URL or compromised web page (User Interaction: Required). The vulnerability is notable for a scope change (S:C) in its CVSS metric, indicating the impact extends beyond the immediate security scope of the software component. Adobe has released patches to address this issue in the affected versions.
Affected products
- Adobe Adobe Commerce / Magento Open Source 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier
Timeline
- 2026-05-12: disclosed: Initial disclosure by Adobe and NVD publication.
- 2026-05-12: advisory: Adobe security bulletin APSB26-49 released.