Adobe Commerce | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

CVE-2025-24406 is a path traversal vulnerability in Adobe Commerce affecting versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11, and earlier. The vulnerability arises from improper limitation of a pathname to a restricted directory, enabling attackers to bypass security restrictions [1].

An unauthenticated attacker can exploit this flaw without user interaction by sending crafted requests that traverse directory paths. This allows access to files located outside the intended restricted directory [1].

Successful exploitation could lead to unauthorized modification of sensitive files, potentially resulting in a security feature bypass. This could compromise the integrity of the application and allow further attacks [1].