CVE-2026-34653
Essential information
- Published
- 12/05/2026 20:16
- Modified
- 13/05/2026 14:49
- Author
- —
- Creator
- —
- CVSS
- 8.7 HIGH (v3.1)
- CISA KEV
- No
- CWE
- —
- CVSS vector
-
—
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N—
CVSS metrics
- Access vector
- —
- Access complexity
- —
- Authentication
- —
- Confidentiality impact
- —
- Integrity impact
- —
- Availability impact
- —
- Exploitability
- —
- Remediation level
- —
- Report confidence
- —
- Temporal score
- —
- Attack vector
- NETWORK
- Attack complexity
- LOW
- Privileges required
- HIGH
- User interaction
- NONE
- Scope
- CHANGED
- Confidentiality impact
- HIGH
- Integrity impact
- HIGH
- Availability impact
- NONE
- Exploit code maturity
- —
- Remediation level
- —
- Report confidence
- —
- Temporal score
- —
- Attack vector
- —
- Attack complexity
- —
- Attack requirements
- —
- Privileges required
- —
- User interaction
- —
- Confidentiality (V)
- —
- Confidentiality (S)
- —
- Integrity (V)
- —
- Integrity (S)
- —
- Availability (V)
- —
- Availability (S)
- —
- Exploit maturity
- —
Description
Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary file system read and write. An authenticated attacker with administrative privileges could exploit this vulnerability to read or write files outside the restricted directory. Exploitation of this issue does not require user interaction. Scope is changed.
NVD status
- Status
- Undergoing Analysis — CVE has been recently published to the CVE List and has been received by the NVD.
- Source
- [email protected]
- NVD
- View on NVD
Affected products (CPE)
| Product | CPE |
|---|---|
| adobe / adobe commerce | cpe:2.3:a:adobe:adobe_commerce:2.4.9-beta1:*:*:*:*:*:*:* |
| adobe / adobe commerce | cpe:2.3:a:adobe:adobe_commerce:2.4.8:p4:*:*:*:*:*:* |
| adobe / adobe commerce | cpe:2.3:a:adobe:adobe_commerce:2.4.7:p9:*:*:*:*:*:* |
| adobe / adobe commerce | cpe:2.3:a:adobe:adobe_commerce:2.4.6:p14:*:*:*:*:*:* |
| adobe / adobe commerce | cpe:2.3:a:adobe:adobe_commerce:2.4.5:p16:*:*:*:*:*:* |
| adobe / adobe commerce | cpe:2.3:a:adobe:adobe_commerce:2.4.4:p17:*:*:*:*:*:* |
| adobe / adobe commerce | cpe:2.3:a:adobe:adobe_commerce:<2.4.4:*:*:*:*:*:* |