CVE-2023-26367

Error based file extraction via PHP filter chains during product bulk import logic

Published Oct 13, 2023 CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed
Description
Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by an Improper Input Validation vulnerability that could lead to arbitrary file system read by an admin-privilege authenticated attacker. Exploitation of this issue does not require user interaction.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2023-30187 Magento Open Source has Improper Input Validation Vulnerability
Github GHSA Github GHSA GHSA-9mx6-4gg4-85xj Magento Open Source has Improper Input Validation Vulnerability
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Weaknesses

Sources

Status
PUBLISHED
Assigner
adobe
Published
Updated
Feb 27, 2025, 8:41 PM
Reserved
Feb 22, 2023, 7:47 PM
Status
Modified
Published
Oct 13, 2023, 7:15 AM
Modified
Jun 17, 2026, 5:43 AM