Vulnerability advisory

GHSA-fx9g-g9q6-x3jx

Magento Path Traversal vulnerability

Published Aug 17, 2022Updated Sep 10, 2026OSV record ↗

Also known as BIT-magento-2022-34254CVE-2022-34254

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

Affected versions

magento/community-edition Packagist

All magento/community-edition advisories →

Affected	Fixed in
`2.3.0` to before 2.3.7-p4	`2.3.7-p4`Advisories →
Also listed as affected (17) `2.3.0` `2.3.1` `2.3.2` `2.3.2-p2` `2.3.3` `2.3.3-p1` `2.3.4` `2.3.4-p2` `2.3.5` `2.3.5-p1` `2.3.5-p2` `2.3.6` `2.3.6-p1` `2.3.7` `2.3.7-p1` `2.3.7-p2` `2.3.7-p3`
`2.4.0` to before 2.4.3-p3	`2.4.3-p3`Advisories →
Also listed as affected (10) `2.4.0` `2.4.0-p1` `2.4.1` `2.4.1-p1` `2.4.2` `2.4.2-p1` `2.4.2-p2` `2.4.3` `2.4.3-p1` `2.4.3-p2`
`2.4.4` to before 2.4.5	`2.4.5`Advisories →
Also listed as affected (14) `2.4.4` `2.4.4-p1` `2.4.4-p10` `2.4.4-p11` `2.4.4-p12` `2.4.4-p13` `2.4.4-p2` `2.4.4-p3` `2.4.4-p4` `2.4.4-p5` `2.4.4-p6` `2.4.4-p7` `2.4.4-p8` `2.4.4-p9`

Description

Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could be abused by an attacker to inject malicious scripts into the vulnerable endpoint. A low privileged attacker could leverage this vulnerability to read local files and to perform Stored XSS. Exploitation of this issue does not require user interaction.

GHSA-fx9g-g9q6-x3jx

Affected versions

magento/community-edition Packagist

Description

References