← Back

CVE-2026-77110

nvd nist
Published: Sep 8, 2026Modified: Sep 10, 2026

JSON object

Loading...
7.6
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:L
Exploitability: 2.3 / Impact: 4.7
Source: psirt@adobe.com (Secondary)

Description

Adobe Commerce is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in a Security feature bypass. An attacker with high privileges could leverage this vulnerability to access unauthorized files or directories outside the intended restrictions, causing a limited disruption to availability. Exploitation of this issue does not require user interaction. Scope is changed.

Affected (157)

Adobe
3 products
Commerce
Commerce B2b
Magento
Configuration A
77 vulnerable
Vulnerable SoftwareAffected Versions
Adobe
Commerce
version < 2.4.4
Commerce
Version 2.4.4
Commerce
Version 2.4.4 p10
Commerce
Version 2.4.4 p11
Commerce
Version 2.4.4 p12
Commerce
Version 2.4.4 p13
Commerce
Version 2.4.4 p14
Commerce
Version 2.4.4 p15
Commerce
Version 2.4.4 p16
Commerce
Version 2.4.4 p17
Commerce
Version 2.4.4 p18
Commerce
Version 2.4.4 p1
Commerce
Version 2.4.4 p2
Commerce
Version 2.4.4 p3
Commerce
Version 2.4.4 p4
Commerce
Version 2.4.4 p5
Commerce
Version 2.4.4 p6
Commerce
Version 2.4.4 p7
Commerce
Version 2.4.4 p8
Commerce
Version 2.4.4 p9
Commerce
Version 2.4.5
Commerce
Version 2.4.5 p10
Commerce
Version 2.4.5 p11
Commerce
Version 2.4.5 p12
Commerce
Version 2.4.5 p13
Commerce
Version 2.4.5 p14
Commerce
Version 2.4.5 p15
Commerce
Version 2.4.5 p16
Commerce
Version 2.4.5 p17
Commerce
Version 2.4.5 p1
Commerce
Version 2.4.5 p2
Commerce
Version 2.4.5 p3
Commerce
Version 2.4.5 p4
Commerce
Version 2.4.5 p5
Commerce
Version 2.4.5 p6
Commerce
Version 2.4.5 p7
Commerce
Version 2.4.5 p8
Commerce
Version 2.4.5 p9
Commerce
Version 2.4.6
Commerce
Version 2.4.6 p10
Commerce
Version 2.4.6 p11
Commerce
Version 2.4.6 p12
Commerce
Version 2.4.6 p13
Commerce
Version 2.4.6 p14
Commerce
Version 2.4.6 p15
Commerce
Version 2.4.6 p1
Commerce
Version 2.4.6 p2
Commerce
Version 2.4.6 p3
Commerce
Version 2.4.6 p4
Commerce
Version 2.4.6 p5
Commerce
Version 2.4.6 p6
Commerce
Version 2.4.6 p7
Commerce
Version 2.4.6 p8
Commerce
Version 2.4.6 p9
Commerce
Version 2.4.7
Commerce
Version 2.4.7 b1
Commerce
Version 2.4.7 b2
Commerce
Version 2.4.7 beta3
Commerce
Version 2.4.7 p10
Commerce
Version 2.4.7 p1
Commerce
Version 2.4.7 p2
Commerce
Version 2.4.7 p3
Commerce
Version 2.4.7 p4
Commerce
Version 2.4.7 p5
Commerce
Version 2.4.7 p6
Commerce
Version 2.4.7 p7
Commerce
Version 2.4.7 p8
Commerce
Version 2.4.7 p9
Commerce
Version 2.4.8
Commerce
Version 2.4.8 beta1
Commerce
Version 2.4.8 beta2
Commerce
Version 2.4.8 p1
Commerce
Version 2.4.8 p2
Commerce
Version 2.4.8 p3
Commerce
Version 2.4.8 p4
Commerce
Version 2.4.8 p5
Commerce
Version 2.4.9
Configuration B
56 vulnerable
Vulnerable SoftwareAffected Versions
Adobe
Commerce B2b
version < 1.3.3
Commerce B2b
Version 1.3.3
Commerce B2b
Version 1.3.3 p10
Commerce B2b
Version 1.3.3 p11
Commerce B2b
Version 1.3.3 p12
Commerce B2b
Version 1.3.3 p13
Commerce B2b
Version 1.3.3 p14
Commerce B2b
Version 1.3.3 p15
Commerce B2b
Version 1.3.3 p16
Commerce B2b
Version 1.3.3 p17
Commerce B2b
Version 1.3.3 p18
Commerce B2b
Version 1.3.3 p1
Commerce B2b
Version 1.3.3 p2
Commerce B2b
Version 1.3.3 p3
Commerce B2b
Version 1.3.3 p4
Commerce B2b
Version 1.3.3 p5
Commerce B2b
Version 1.3.3 p6
Commerce B2b
Version 1.3.3 p7
Commerce B2b
Version 1.3.3 p8
Commerce B2b
Version 1.3.3 p9
Commerce B2b
Version 1.3.4
Commerce B2b
Version 1.3.4 p10
Commerce B2b
Version 1.3.4 p11
Commerce B2b
Version 1.3.4 p12
Commerce B2b
Version 1.3.4 p13
Commerce B2b
Version 1.3.4 p14
Commerce B2b
Version 1.3.4 p15
Commerce B2b
Version 1.3.4 p16
Commerce B2b
Version 1.3.4 p17
Commerce B2b
Version 1.3.4 p1
Commerce B2b
Version 1.3.4 p2
Commerce B2b
Version 1.3.4 p3
Commerce B2b
Version 1.3.4 p4
Commerce B2b
Version 1.3.4 p5
Commerce B2b
Version 1.3.4 p6
Commerce B2b
Version 1.3.4 p7
Commerce B2b
Version 1.3.4 p8
Commerce B2b
Version 1.3.4 p9
Commerce B2b
Version 1.4.2
Commerce B2b
Version 1.4.2 p10
Commerce B2b
Version 1.4.2 p1
Commerce B2b
Version 1.4.2 p2
Commerce B2b
Version 1.4.2 p3
Commerce B2b
Version 1.4.2 p4
Commerce B2b
Version 1.4.2 p5
Commerce B2b
Version 1.4.2 p6
Commerce B2b
Version 1.4.2 p7
Commerce B2b
Version 1.4.2 p8
Commerce B2b
Version 1.4.2 p9
Commerce B2b
Version 1.5.2
Commerce B2b
Version 1.5.2 p1
Commerce B2b
Version 1.5.2 p2
Commerce B2b
Version 1.5.2 p3
Commerce B2b
Version 1.5.2 p4
Commerce B2b
Version 1.5.2 p5
Commerce B2b
Version 1.5.3
Configuration C
24 vulnerable
Vulnerable SoftwareAffected Versions
Adobe
Magento
version ≤ 2.4.6
Magento
Version 2.4.7
Magento
Version 2.4.7 b1
Magento
Version 2.4.7 b2
Magento
Version 2.4.7 beta3
Magento
Version 2.4.7 p10
Magento
Version 2.4.7 p1
Magento
Version 2.4.7 p2
Magento
Version 2.4.7 p3
Magento
Version 2.4.7 p4
Magento
Version 2.4.7 p5
Magento
Version 2.4.7 p6
Magento
Version 2.4.7 p7
Magento
Version 2.4.7 p8
Magento
Version 2.4.7 p9
Magento
Version 2.4.8
Magento
Version 2.4.8 beta1
Magento
Version 2.4.8 beta2
Magento
Version 2.4.8 p1
Magento
Version 2.4.8 p2
Magento
Version 2.4.8 p3
Magento
Version 2.4.8 p4
Magento
Version 2.4.8 p5
Magento
Version 2.4.9

Related CWEs

CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References (1)

Source: psirt@adobe.com
Vendor Advisory

Timeline

No history available yet.