Description
Adobe Commerce is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in a Security feature bypass. An attacker with high privileges could leverage this vulnerability to access unauthorized files or directories outside the intended restrictions, causing a limited disruption to availability. Exploitation of this issue does not require user interaction. Scope is changed.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Adobe | Adobe Commerce | ≤ 2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug, 2.4.5-2026-aug, 2.4.4-2026-aug | 2.4.9-2026-sep, 2.4.8-2026-sep, 2.4.7-2026-sep, 2.4.6-2026-sep, 2.4.5-2026-sep, 2.4.4-2026-sep |
| Adobe | Adobe Commerce B2B | ≤ 1.5.3-2026-aug, 1.5.2-2026-aug, 1.4.2-2026-aug, 1.3.4-2026-aug, 1.3.3-2026-aug | 1.5.3-2026-sep, 1.5.2-2026-sep, 1.4.2-2026-sep, 1.3.4-2026-sep, 1.3.3-2026-sep |
| Adobe | Magento Open Source | ≤ 2.4.9-2026-aug, 2.4.8-2026-aug, 2.4.7-2026-aug, 2.4.6-2026-aug | 2.4.9-2026-sep, 2.4.8-2026-sep, 2.4.7-2026-sep |
Advisories 2
- NCSC-2026-0361 Kwetsbaarheden verholpen in Adobe Commerce NCSC-NL (Netherlands) · Sep 9, 2026
- WID-SEC-2026-3246 Adobe Magento: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 8, 2026