Adobe Commerce | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

Vulnerability

Overview

CVE-2025-49559 is an Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) vulnerability affecting Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14, and earlier [1]. The root cause is insufficient validation of user-supplied path input, allowing an attacker to traverse directories outside the intended restricted area.

Attack

Vector and Requirements

An attacker can exploit this vulnerability remotely without requiring user interaction or authentication [1]. No special privileges are needed, and the attack can be launched over the network. The exploit does not require any prior access or credentials.

Impact

Successful exploitation results in a security feature bypass, enabling the attacker to modify limited data within the application [1]. The scope of modification is restricted, but it can still lead to unauthorized changes that may affect the integrity of the store or its configuration.

Mitigation

Adobe has not yet released a patch for this vulnerability as of the publication date [1]. Users should monitor Adobe’s security advisory for updates. The official Magento Open Source repository provides the source code for review and potential workaround development [2].