Adobe Commerce has an improper limitation of a pathname to a restricted directory (CWE-22). Key detail from the vendor description: a high‑privileged attacker could manipulate file paths to access or modify files outside the intended restricted directory. This flaw could expose sensitive configuration files, images, or even code. The impact is a breach of confidentiality and potential integrity compromise of the e‑commerce platform. No user interaction is required, meaning that once the attacker gains the necessary privilege level, the attack can be performed automatically.

Affected products are Adobe Commerce (Magento Open Source) as identified in the CPE list. The CVE description lists the specific affected releases: 2.4.9‑alpha3, 2.4.8‑p3, 2.4.7‑p8, 2.4.6‑p13, 2.4.5‑p15, 2.4.4‑p16 and all earlier versions. Any installation of these releases is potentially vulnerable until the official patch is applied.

The base CVSS score is 6.8, indicating a medium‑high severity, while the EPSS score of less than 1% suggests a currently low exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. Attackers need high‑privilege access to the system to exploit the flaw, but because the attack does not require user interaction, the threat is straightforward for anyone who has or can elevate to the required permissions. The primary risk to affected systems is unauthorized file disclosure or modification.