Skip to content
OpenAdvisories
High · 7.2 CVE-2021-36031 EUVD-2021-22664GHSA-7w95-qwhh-q9p3

Magento Commerce Path Traversal In `theme[preview_image]` Parameter Could Lead To Remote Code Execution

Published Sep 1, 2021 · Updated Sep 17, 2024 · Assigned by adobe

Vendor: Adobe Product: Magento Commerce Package: magento/community-edition Package: magento/project-community-edition Category: Web / CMS Ecosystem: Packagist

Description

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a Path Traversal vulnerability via the `theme[preview_image]` parameter. An attacker with admin privileges could leverage this vulnerability to achieve remote code execution.

Affected products

VendorProductAffectedFixed
Adobe Magento Commerce unspecified – ≤ 2.4.2, unspecified – ≤ 2.4.2-p1, unspecified – ≤ 2.3.7, unspecified – ≤ None —

Affected packages

EcosystemPackageAffectedFixedRecord
Packagist magento/community-edition < 2.3.7-p1 2.3.7-p1 GHSA-7w95-qwhh-q9p3
Packagist magento/community-edition 2.3.7 — GHSA-7w95-qwhh-q9p3
Packagist magento/community-edition >= 2.4.2-p1, < 2.4.2-p2 2.4.2-p2 GHSA-7w95-qwhh-q9p3
Packagist magento/community-edition 2.4.2 — GHSA-7w95-qwhh-q9p3
Packagist magento/project-community-edition <= 2.0.2 — GHSA-7w95-qwhh-q9p3

References