GitHub Advisoryadvisory · Packagist

GHSA-wh92-6q6g-px7j Magento Community Edition Improper Input Validation vulnerability

CRITICAL Published 2025-09-09 Modified 2025-10-27 Official page ↗
Aliases
CVE-2025-54236
Ecosystem
Packagist
Packages
magento/community-edition, magento/project-community-edition
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-20
Reviewed
2025-09-10

Affected packages

• Packagist magento/community-edition: <= 2.4.5-p14 (no fix yet) • Packagist magento/community-edition: 2.4.6 (no fix yet) • Packagist magento/community-edition: >= 2.4.6-p1, <= 2.4.6-p12 (no fix yet) • Packagist magento/community-edition: 2.4.5 (no fix yet) • Packagist magento/community-edition: >= 2.4.9-alpha1, <= 2.4.9-alpha2 (no fix yet) • Packagist magento/community-edition: 2.4.7 (no fix yet) • Packagist magento/community-edition: 2.4.8 (no fix yet) • Packagist magento/community-edition: >= 2.4.7-beta1, <= 2.4.7-p7 (no fix yet) • Packagist magento/community-edition: >= 2.4.8-beta1, <= 2.4.8-p2 (no fix yet) • Packagist magento/community-edition: 2.4.9 (no fix yet) • Packagist magento/project-community-edition: <= 2.0.2 (no fix yet)

Description

Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality and integrity impact to high. Exploitation of this issue does not require user interaction.

Related

Alias · CVE (1)

  • CVE-2025-54236 Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input… vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References