Magento vulnerable to path traversal

中 5.3CVE-2025-49559 · GHSA-h4f4-gv6h-x824 · 12/08/2025 公開 · 17/06/2026 更新

要点

CVE-2025-49559 は magento/community-edition, magento/project-community-edition, commerce (adobe) に影響する深刻度「中」 (CVSS 5.3) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.73%（全脆弱性の 54.3% より高い）。
対処：2.4.6-p12, 2.4.7-p7, 2.4.8-p2, 2.4.9-alpha2 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
magento/community-edition Packagist	`= 2.4.5= 2.4.6= 2.4.7= 2.4.8≥ 2.4.6-p1, < 2.4.6-p12≥ 2.4.7-beta1, < 2.4.7-p7≥ 2.4.8-beta1, < 2.4.8-p2≥ 2.4.9-alpha1, < 2.4.9-alpha2< 2.4.5-p14`	`2.4.6-p122.4.7-p72.4.8-p22.4.9-alpha22.4.5-p14`
magento/project-community-edition Packagist	`≤ 2.0.2`	修正版なし
commerce adobe	`= 2.4.4= 2.4.5= 2.4.6= 2.4.7= 2.4.8< 2.4.4`	`2.4.4`
commerce b2b adobe	`= 1.3.3= 1.3.4= 1.3.5= 1.4.2= 1.5.2= 1.5.3< 1.3.3`	`1.3.3`
magento adobe	`= 2.4.5= 2.4.6= 2.4.7= 2.4.8= 2.4.9< 2.4.5`	`2.4.5`

概要

Magento versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in a security feature bypass. An attacker could leverage this vulnerability to modify limited data. Exploitation of this issue does not require user interaction.

NVD の説明

Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in a security feature bypass. An attacker could leverage this vulnerability to modify limited data. Exploitation of this issue does not require user interaction.