Improper input validation, identified as CWE‑20, allows a high‑privileged attacker to bypass security controls in Adobe Commerce. The vulnerability can be triggered by a maliciously crafted URL visited by a user, and it results in unauthorized write access to the file system. Scope is changed, indicating that an attacker could gain elevated privileges once the bypass succeeds. The CVSS score of 3.4 reflects a low overall severity but highlights the potential for significant impact if exploited.

Adobe Commerce versions 2.4.9‑beta1, 2.4.8‑p4, 2.4.7‑p9, 2.4.6‑p14, 2.4.5‑p16, 2.4.4‑p17 and all earlier releases are affected. The affected product is Adobe Commerce (formerly Magento) provided by Adobe.

The CVSS score indicates low exploitability overall, but the requirement for user interaction reduces the probability that an attacker can gain the necessary context. The EPSS score is not available and the vulnerability is not listed in CISA KEV, suggesting no known public exploits. However, the scope change to a high‑privileged state means that once an attacker achieves a written string through a web request, they can execute write operations that normally would have been restricted, exposing the system to potential data tampering or persistence mechanisms.