Vulnerability details
CVE-2026-34653
Adobe CommerceAdobe Commerce B2BAdobe Magento Open Source
Adobe Commerce | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
CVSS 3.1
8.7High
Official description
Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary file system read and write. An authenticated attacker with administrative privileges could exploit this vulnerability to read or write files outside the restricted directory. Exploitation of this issue does not require user interaction. Scope is changed.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 8.7High | 3.1 | CVEProject cvelistV5 (CNA) (adobe) | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Adobe | Adobe Commerce | v ≤ 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 | CVEProject cvelistV5 (CNA) |
| Adobe | Adobe Commerce B2B | v ≤ 1.5.3-beta1, 1.5.2-p4, 1.4.2-p9, 1.3.4-p16, 1.3.3-p17 | CVEProject cvelistV5 (CNA) |
| Adobe | Magento Open Source | v ≤ 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14 | CVEProject cvelistV5 (CNA) |
References and advisories
1- https://helpx.adobe.com/security/products/magento/apsb26-49.html vendor-advisory
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-05-12
- Last updated
- 2026-08-28
- State
- Published
- Assigner (CNA)
- adobe
Exploit prediction (EPSS)
0.6%
Probability of exploitation in 30 days
49.1%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Total
Weaknesses (CWE)
- CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)