CVE-2025-24406

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-24406
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-24406.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-24406
Aliases
Published
2025-02-11T18:15:41.300Z
Modified
2026-04-10T05:23:02.379793Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
Summary
[none]
Details

Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to a security feature bypass. An unauthenticated attacker could exploit this vulnerability to modify files that are stored outside the restricted directory. Exploitation of this issue does not require user interaction.

References

Affected packages

Git / github.com/magento/magento2

Affected ranges

Type
GIT
Repo
https://github.com/magento/magento2
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
0f9a056c8d83c4f319626b3e56ec52a533999f25
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
0f9a056c8d83c4f319626b3e56ec52a533999f25
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
5548bc64b5bc904346c0af9193a7fbb5274b4efa
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
712cea4825f6067e1e7ed629abc2bd9eed157a12
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
29f9a054bfe9892e9656558fc9a19174118f918d
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
ef922155dbe6321862b3811e2472f2790489e685
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
e18651b120784046b22e146ca1ab5d79493ed8a4
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
c739d2113ebbbdceede4fa0dd6b0a0fc3e83355c
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
a2ded45232876973af6e30fe312b76c0de77ebf3
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
73f312a2f9bc43ee6bf436cb4e26ee20f6901322
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
7aef59b58158c2c5f031a15550e590e3b499c989
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
9721cc22eb32482d82e5e3d275fe3a0221d8b750
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
30877fce83b793f71421c47347885cf076e81799
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
1df4565907d40f14ee1c753cc2de2ce567bfa8d7
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
11846a1a10539470f2fe1522030ff42d62daa562
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
ca0c22e48ad5adb5726b5a949a702e99937c04c3
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
3e26248d2ccb4b52d75e6188bb1fc93dd691c254
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
58dfc61e7b545bdeaf3c3a2dac489e8770d85656
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
4d4e0e2ebf249a00c5f5aa1eaec3f24575133b62
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
d6f014854784eccd39d2ecb35c4beeb82d59b309
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
5bb9fe778e521cf2f3b35433c196d6ed2fd5ecb9
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
eb27f55ff8d66db98e60784efa6d737b8ec94734
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
a3c6d6e5e95e63031e4df26cfcf76feace7549c2
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
6fedf5c513623ecc8a1a580501a49a1331e68568
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
d846142a3ab8b49597dfb8bd7508d875efdab19a
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
727560d82199f6b938d1906e9d923e2dd40b490a
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
37861a4025ef7f18016d3ab149e006da46821784
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
6cc0d28cf66074adebc261e981eb35811601f813
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
b57e30c9ae27e513da830ad1d3b20c6a94afa0e7
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
a3179be22a602e83f7e1eca187d5f8a927ef392c
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
c5c538810b87449886f4669cb8abbe8e5593c83c
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
06099d29b333ac4acd68f051905717202b7221a0
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
6d1912708f8888efb6be037386515f566aa0d65a
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
fcebd3a4ad2a6863af2e2092f5e548cbd81cb0f8
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
d10435b11ada4e502dca7539f8fd31d059d3c482
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
d196d504d8b387454a123033ec2a74d7fd3d5430
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
ccc675d091d16bb90fa035c47f6f7dd410ac3e40
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
c5056c77ddfd62022a4381aae750bf403100e4c7
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
0f9a056c8d83c4f319626b3e56ec52a533999f25
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
0f9a056c8d83c4f319626b3e56ec52a533999f25
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
5548bc64b5bc904346c0af9193a7fbb5274b4efa
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
712cea4825f6067e1e7ed629abc2bd9eed157a12
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
29f9a054bfe9892e9656558fc9a19174118f918d
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
ef922155dbe6321862b3811e2472f2790489e685
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
e18651b120784046b22e146ca1ab5d79493ed8a4
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
c739d2113ebbbdceede4fa0dd6b0a0fc3e83355c
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
a2ded45232876973af6e30fe312b76c0de77ebf3
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
73f312a2f9bc43ee6bf436cb4e26ee20f6901322
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
7aef59b58158c2c5f031a15550e590e3b499c989
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
9721cc22eb32482d82e5e3d275fe3a0221d8b750
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
30877fce83b793f71421c47347885cf076e81799
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
1df4565907d40f14ee1c753cc2de2ce567bfa8d7
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
11846a1a10539470f2fe1522030ff42d62daa562
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
ca0c22e48ad5adb5726b5a949a702e99937c04c3
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
3e26248d2ccb4b52d75e6188bb1fc93dd691c254
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
58dfc61e7b545bdeaf3c3a2dac489e8770d85656
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
4d4e0e2ebf249a00c5f5aa1eaec3f24575133b62
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
d6f014854784eccd39d2ecb35c4beeb82d59b309
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
5bb9fe778e521cf2f3b35433c196d6ed2fd5ecb9
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
eb27f55ff8d66db98e60784efa6d737b8ec94734
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
a3c6d6e5e95e63031e4df26cfcf76feace7549c2
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
6fedf5c513623ecc8a1a580501a49a1331e68568
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
d846142a3ab8b49597dfb8bd7508d875efdab19a
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
727560d82199f6b938d1906e9d923e2dd40b490a
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
37861a4025ef7f18016d3ab149e006da46821784
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
6cc0d28cf66074adebc261e981eb35811601f813
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
b57e30c9ae27e513da830ad1d3b20c6a94afa0e7
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
a3179be22a602e83f7e1eca187d5f8a927ef392c
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
c5c538810b87449886f4669cb8abbe8e5593c83c
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
06099d29b333ac4acd68f051905717202b7221a0
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
6d1912708f8888efb6be037386515f566aa0d65a
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
fcebd3a4ad2a6863af2e2092f5e548cbd81cb0f8
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
d10435b11ada4e502dca7539f8fd31d059d3c482
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
d196d504d8b387454a123033ec2a74d7fd3d5430
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
ccc675d091d16bb90fa035c47f6f7dd410ac3e40
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
c5056c77ddfd62022a4381aae750bf403100e4c7
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.4.4"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.4.4-NA"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.4.4-p1"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.4.4-p10"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.4.4-p11"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.4.4-p2"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.4.4-p3"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.4.4-p4"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.4.4-p5"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.4.4-p6"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.4.4-p7"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.4.4-p8"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.4.4-p9"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.4.5-NA"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.4.5-p1"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.4.5-p10"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.4.5-p2"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.4.5-p3"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.4.5-p4"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.4.5-p5"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.4.5-p6"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.4.5-p7"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.4.5-p8"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.4.5-p9"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.4.6-NA"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.4.6-p1"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.4.6-p2"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.4.6-p3"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.4.6-p4"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.4.6-p5"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.4.6-p6"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.4.6-p7"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.4.6-p8"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.4.7-NA"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.4.7-p1"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.4.7-p2"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.4.7-p3"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.4.8-beta1"
        },
        {
            "introduced": "0"
        },
        {
            "fixed": "2.4.4"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.4.4-NA"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.4.4-p1"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.4.4-p10"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.4.4-p11"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.4.4-p2"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.4.4-p3"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.4.4-p4"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.4.4-p5"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.4.4-p6"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.4.4-p7"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.4.4-p8"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.4.4-p9"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.4.5-NA"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.4.5-p1"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.4.5-p10"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.4.5-p2"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.4.5-p3"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.4.5-p4"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.4.5-p5"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.4.5-p6"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.4.5-p7"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.4.5-p8"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.4.5-p9"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.4.6-NA"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.4.6-p1"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.4.6-p2"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.4.6-p3"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.4.6-p4"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.4.6-p5"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.4.6-p6"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.4.6-p7"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.4.6-p8"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.4.7-NA"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.4.7-p1"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.4.7-p2"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.4.7-p3"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.4.8-beta1"
        }
    ]
}

Affected versions

0.*
0.1.0-alpha100
0.1.0-alpha101
0.1.0-alpha102
0.1.0-alpha103
0.1.0-alpha104
0.1.0-alpha105
0.1.0-alpha106
0.1.0-alpha107
0.1.0-alpha108
0.1.0-alpha89
0.1.0-alpha90
0.1.0-alpha91
0.1.0-alpha92
0.1.0-alpha93
0.1.0-alpha94
0.1.0-alpha95
0.1.0-alpha96
0.1.0-alpha97
0.1.0-alpha98
0.1.0-alpha99
0.42.0-beta1
0.42.0-beta3
0.74.0-beta1
2.*
2.0.0
2.0.0-rc
2.1.0
2.1.0-rc1
2.1.0-rc2
2.1.0-rc3
2.2.0-RC1.1
2.2.0-RC1.2
2.2.0-RC1.3
2.4.4
2.4.4-p1
2.4.4-p10
2.4.4-p11
2.4.4-p2
2.4.4-p3
2.4.4-p4
2.4.4-p5
2.4.4-p6
2.4.4-p7
2.4.4-p8
2.4.4-p9
2.4.5
2.4.5-p1
2.4.5-p10
2.4.5-p2
2.4.5-p3
2.4.5-p4
2.4.5-p5
2.4.5-p6
2.4.5-p7
2.4.5-p8
2.4.5-p9
2.4.6
2.4.6-p1
2.4.6-p2
2.4.6-p3
2.4.6-p4
2.4.6-p5
2.4.6-p6
2.4.6-p7
2.4.6-p8
2.4.7
2.4.7-p1
2.4.7-p2
2.4.7-p3
2.4.8-beta1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-24406.json"
unresolved_ranges 
[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "fixed": "1.3.3"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "1.3.3-NA"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "1.3.3-p10"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "1.3.3-p11"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "1.3.4-NA"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "1.3.4-p10"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "1.3.4-p9"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "1.3.5-NA"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "1.3.5-p7"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "1.3.5-p8"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "1.4.2-NA"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "1.4.2-p1"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "1.4.2-p2"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "1.4.2-p3"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "1.5.0"
            }
        ]
    }
]