Product:
Adobe Commerce
Summary
Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by a Path Traversal vulnerability that could result in arbitrary file system read and write. An authenticated attacker with administrative privileges could exploit this vulnerability to read or write files outside the restricted directory. Exploitation does not require user interaction.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.7 | CVE-2026-34653 |
Exploitation
To exploit this vulnerability, an authenticated attacker with administrative privileges can craft requests that manipulate the pathname to access files outside the intended directory. This can be done by sending specially crafted input that bypasses the restrictions in place, allowing the attacker to read or write sensitive files on the server.
Affected Products
- Adobe Commerce 2.4.9-beta1
- Adobe Commerce 2.4.8-p4
- Adobe Commerce 2.4.7-p9
- Adobe Commerce 2.4.6-p14
- Adobe Commerce 2.4.5-p16
- Adobe Commerce 2.4.4-p17
Mitigation
To mitigate this vulnerability, it is recommended to update to the latest version of Adobe Commerce that addresses this issue. Additionally, administrators should review their file permissions and ensure that sensitive directories are properly secured to prevent unauthorized access.