Description
Adobe Commerce and Magento contain an unrestricted upload of file with dangerous type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session.
Full record on cve.org →Affected packages
| Package | Vendor / Product | Version range | Status |
|---|---|---|---|
| Adobe Commerce | Adobe / Adobe Commerce | >= 0, <= 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, 2.4.4-p18 | affected |
| Adobe Commerce | Adobe / Adobe Commerce | 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul, 2.4.5-2026-jul, 2.4.4-2026-jul | unaffected |
| Adobe Commerce B2B | Adobe / Adobe Commerce B2B | >= 0, <= 1.5.3, 1.5.2-p5, 1.4.2-p10, 1.3.4-p17, 1.3.3-p18 | affected |
| Adobe Commerce B2B | Adobe / Adobe Commerce B2B | 1.5.3-2026-jul, 1.5.2-2026-jul, 1.4.2-2026-jul, 1.3.4-2026-jul, 1.3.3-2026-jul | unaffected |
| Adobe Commerce Events | Adobe / Adobe Commerce Events | >= 0, <= 1.20.0 | affected |
| Adobe Commerce Events | Adobe / Adobe Commerce Events | 1.21.0 | unaffected |
| Magento Open Source | Adobe / Magento Open Source | >= 0, <= 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15 | affected |
| Magento Open Source | Adobe / Magento Open Source | 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul | unaffected |