Error based file extraction via PHP filter chains during product bulk import logic

Adobe Commerce versions 2.4.7-beta1, 2.4.6-p2, 2.4.5-p4, 2.4.4-p5, and earlier are affected by an Improper Input Validation vulnerability [1]. This flaw allows an attacker with admin privileges to read arbitrary files from the file system, potentially exposing sensitive information such as configuration files, database credentials, or other critical data. The vulnerability does not require any user interaction, making it easier to exploit once admin access is obtained.

The attack can be carried out by an authenticated admin user, who can send specially crafted requests that bypass validation checks, leading to unintended file reads. The attacker must already have administrative access, which limits the attack surface but significantly increases the impact if such access is compromised.

Successful exploitation could allow an attacker to read arbitrary files, potentially leading to further compromise of the system, such as extraction of secrets, source code, or other sensitive data. Adobe has released security updates to address this issue; users are advised to upgrade to the latest versions or apply patches provided by Adobe [1].