GitHub Advisoryadvisory · Packagist

GHSA-6cwv-wj7v-73xp Magento executes code via the API File Option Upload Extension

CRITICAL Published 2022-05-24 Modified 2025-11-07 Official page ↗
Aliases
CVE-2021-36042
Ecosystem
Packagist
Packages
magento/project-community-edition, magento/community-edition
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Weaknesses
CWE-20
Reviewed
2025-11-07

Affected packages

• Packagist magento/project-community-edition: <= 2.0.2 (no fix yet) • Packagist magento/community-edition: 2.4.2 (no fix yet) • Packagist magento/community-edition: >= 2.4.2-p1, < 2.4.2-p2 → fixed in 2.4.2-p2 • Packagist magento/community-edition: 2.3.7 (no fix yet) • Packagist magento/community-edition: < 2.3.7-p1 → fixed in 2.3.7-p1

Description

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability in the API File Option Upload Extension. An attacker with Admin privileges can achieve unrestricted file upload which can result in remote code execution.

Related

Alias · CVE (1)

  • CVE-2021-36042 Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation… vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References