This vulnerability is an improper limitation of a pathname to a restricted directory, allowing a path traversal attack. An authenticated attacker with administrative privileges can read or write arbitrary files outside the intended directory. The flaw is classified as CWE‑22 and requires no user interaction once the attacker has administrative access. Based on the description, an attacker could read or write files that include critical system or configuration data. The potential for further impact such as code execution is inferred but not explicitly documented in the description.

Adobe Commerce versions 2.4.9-beta1, 2.4.8‑p4, 2.4.7‑p9, 2.4.6‑p14, 2.4.5‑p16, 2.4.4‑p17 and any earlier releases are affected. The vulnerability applies to the Adobe:Adobe Commerce product line.

The CVSS score of 8.7 indicates a high severity. The EPSS score is not available, but the flaw is not listed as a known exploited vulnerability in the KEV catalog. Attacks require authenticated administrative access, limiting the threat surface to privileged accounts. The vulnerability allows read or write of arbitrary files, which could compromise data confidentiality and integrity; further impact is not documented but is inferred.