Description
Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality, and integrity impact to high. Exploitation of this issue does not require user interaction.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Adobe | Adobe Commerce | ≤ 2.4.4-p15 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
Magento SessionReaper
exploit/multi/http/magento_sessionreaper
GitHub 8 repositories
-
wubinworks/magento2-session-reaper-patch ★ 4 · Oct 19, 2025
Patch for CVE-2025-54236(a.k.a Session Reaper) which allows customer account takeover and RCE under certain conditions. This patch is actually a Magento 2 extension and universal compatible for Magen…
-
alexb616/SessionReaper-CVE-2025-54236 ★ 1 · Mar 19, 2026
PoC Magento Session Reaper - CVE-2025-54236
-
bigcartenergy/module-sessionreaper-patch ★ 0 · Nov 7, 2026
Free security patch for Magento Open Source and Mage-OS by Big Cart Energy: closes CVE-2025-54236 (SessionReaper) on the Magento 2.3 and 2.4 releases that have no official fix, as one plugin on the W…
-
Dx3iZ/CVE-2025-54236 ★ 0 · Jul 6, 2026
Adobe Magento SessionReaper LFI Vulnerability
-
brito101/session_reaper_lab ★ 0 · May 24, 2026
Ambiente Docker para demonstração prática da CVE-2025-54236 (SessionReaper): PHP Object Deserialization levando a RCE em Magento Open Source 2.4.7
-
Jenderal92/magento-upload-auto-submit-zoneh ★ 0 · May 13, 2026
SessionReaper-CVE-2025-54236
-
Baba01hacker666/cve-2025-54236 ★ 0 · Dec 30, 2025
cve-2025-54236 poc
-
amalpvatayam67/day01-sessionreaper-lab ★ 0 · Sep 10, 2025
This is a tiny lab that simulates the core idea reported for CVE-2025-54236 (“SessionReaper”)
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Adobe Commerce - Authentication Bypass http/cves/2025/CVE-2025-54236.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | magento/community-edition | <= 2.4.5-p14 | — | GHSA-wh92-6q6g-px7j |
| Packagist | magento/community-edition | 2.4.6 | — | GHSA-wh92-6q6g-px7j |
| Packagist | magento/community-edition | >= 2.4.6-p1, <= 2.4.6-p12 | — | GHSA-wh92-6q6g-px7j |
| Packagist | magento/community-edition | 2.4.5 | — | GHSA-wh92-6q6g-px7j |
| Packagist | magento/community-edition | >= 2.4.9-alpha1, <= 2.4.9-alpha2 | — | GHSA-wh92-6q6g-px7j |
| Packagist | magento/community-edition | 2.4.7 | — | GHSA-wh92-6q6g-px7j |
| Packagist | magento/community-edition | 2.4.8 | — | GHSA-wh92-6q6g-px7j |
| Packagist | magento/community-edition | >= 2.4.7-beta1, <= 2.4.7-p7 | — | GHSA-wh92-6q6g-px7j |
| Packagist | magento/community-edition | >= 2.4.8-beta1, <= 2.4.8-p2 | — | GHSA-wh92-6q6g-px7j |
| Packagist | magento/community-edition | 2.4.9 | — | GHSA-wh92-6q6g-px7j |
| Packagist | magento/project-community-edition | <= 2.0.2 | — | GHSA-wh92-6q6g-px7j |
Advisories 2
- WID-SEC-2025-1999 Adobe Magento SessionReaper: Schwachstelle ermöglicht Umgehung von Sicherheitsmaßnahmen BSI CERT-Bund (WID) · Oct 22, 2025
- NCSC-2025-0284 Kwetsbaarheid verholpen in Adobe Commerce en Magento NCSC-NL (Netherlands) · Sep 10, 2025
References
- https://helpx.adobe.com/security/products/magento/apsb25-88.html vendor-advisory