Product:
Adobe Commerce
Summary
Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by a Path Traversal vulnerability that could result in a security feature bypass. A high-privileged attacker could leverage this vulnerability to access unauthorized files or directories outside the intended restricted path. Exploitation does not require user interaction.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.8 | CVE-2026-21360 |
Exploitation
To exploit this vulnerability, an attacker with high privileges can craft requests that manipulate the pathname to access files or directories that should be restricted. By bypassing the intended security measures, the attacker can retrieve sensitive information stored outside the designated paths without needing any user interaction.
Affected Products
- Adobe Commerce 2.4.9-alpha3: Affected by Path Traversal vulnerability.
- Adobe Commerce 2.4.8-p3: Affected by Path Traversal vulnerability.
- Adobe Commerce 2.4.7-p8: Affected by Path Traversal vulnerability.
- Adobe Commerce 2.4.6-p13: Affected by Path Traversal vulnerability.
- Adobe Commerce 2.4.5-p15: Affected by Path Traversal vulnerability.
- Adobe Commerce 2.4.4-p16: Affected by Path Traversal vulnerability.
Mitigation
To mitigate this vulnerability, it is recommended to update to the latest version of Adobe Commerce that addresses the Path Traversal issue. Additionally, implementing strict access controls and regularly reviewing file permissions can help prevent unauthorized access to sensitive files.