CVE-2025-24406: adobe adobe commerce Path Traversal

Vulnerability summary

CVE-2025-24406 is a high (CVSS 7.5) Path Traversal vulnerability in adobe adobe commerce. EPSS estimates a 1.40% chance of exploitation in the next 30 days, higher than 71.9% of scored vulnerabilities.

Timeline

1. 11-02-2025
   PublishedVulnerability first disclosed.
2. 17-03-2025
   Last modifiedVulnerability information updated.

Description

Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to a security feature bypass. An unauthenticated attacker could exploit this vulnerability to modify files that are stored outside the restricted directory. Exploitation of this issue does not require user interaction.

• CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.