Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)

Vulnerability

Details CVE-2025-49557 is a stored Cross-Site Scripting (XSS) vulnerability in Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier. The vulnerability resides in form fields that do not properly sanitize user input, allowing an attacker to store malicious scripts that execute in the context of a victim's browser session [1].

Exploitation

Prerequisites Exploitation requires a low-privileged attacker who can submit data to vulnerable form fields. The attack chain depends on user interaction: a victim must browse to the page containing the injected script. No special network position is required; the attacker can be authenticated with minimal privileges [1].

Impact

Successful exploitation enables session takeover, providing the attacker with the victim's session credentials. This leads to high confidentiality and integrity impact, as the attacker can access sensitive data and perform actions on behalf of the victim. The vulnerability changes the attack scope, meaning the impact may extend beyond the vulnerable component [1].

Mitigation

Adobe has not released a patch at the time of publication; affected versions include multiple release lines. Users should monitor Adobe Security Bulletins for updates and apply the latest available patches. As a workaround, restrict access to form submission endpoints where possible [1].