CVE-2025-24406: Adobe Commerce Path Traversal Vulnerability
Summary
CVE-2025-24406: Adobe Commerce Path Traversal. Affects magento/community-edition across 4 version ranges.
< 2.4.4-p12
>= 2.4.5-p1, < 2.4.5-p11
>= 2.4.6-p1, < 2.4.6-p9
>= 2.4.7-beta1, < 2.4.7-p4
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Adobe Commerce, also known as Magento, is a widely used open-source e-commerce platform that provides businesses with a flexible and scalable solution for online sales. It offers a range of features including product management, customer management, and order processing. However, certain versions of Adobe Commerce are susceptible to a path traversal vulnerability, which can lead to unauthorized file access and modification.
Vulnerability Detail
The vulnerability arises from an improper limitation of a pathname to a restricted directory, commonly referred to as a 'Path Traversal' issue. This flaw allows an attacker to bypass security mechanisms and modify files stored outside the designated restricted directory. The exploitation of this vulnerability does not require any user interaction, making it particularly dangerous. Affected versions include 2.4.7-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, and 2.4.4-p11, among others.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.4.4-p122.4.4-p12composer require magento/community-edition:2.4.4-p12 -
>= 2.4.5-p1, < 2.4.5-p112.4.5-p11composer require magento/community-edition:2.4.5-p11 -
>= 2.4.6-p1, < 2.4.6-p92.4.6-p9composer require magento/community-edition:2.4.6-p9 -
>= 2.4.7-beta1, < 2.4.7-p42.4.7-p4composer require magento/community-edition:2.4.7-p4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, you can restrict access to sensitive directories and files through server configurations. Ensure that proper permissions are set to limit unauthorized access. However, this is not a substitute for applying the official patch.
Conclusion
The Adobe Commerce Path Traversal vulnerability (CVE-2025-24406) poses a significant risk to users of affected versions. It is crucial to update to the latest patched versions to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor and alert for open-source vulnerabilities in real-time.
See every vulnerability recorded for magento/community-edition →
FAQ
A path traversal vulnerability allows an attacker to access files and directories that are stored outside the intended directory, potentially leading to unauthorized data exposure or modification.
Affected versions include Adobe Commerce 2.4.7-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, and 2.4.4-p11, among others.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
If immediate updates are not possible, implement server-side restrictions to limit access to sensitive files and directories as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for magento/community-edition.
