Magento Path Traversal vulnerability
Impact
Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by a Path Traversal vulnerability when creating a store with child theme.Successful exploitation could lead to arbitrary file system write by an authenticated attacker. Access to the admin console is required for successful exploitation.
Source excerpt · OSVAffected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
| Affected range | Recorded fix |
|---|---|
| From 2.4.0 before 2.4.2-p1Ecosystem versions | 2.4.2-p1 |
| Earlier releases before 2.3.7Ecosystem versions | 2.3.7 |
Version evidence: OSV · GHSA-7gpv-xrjr-f5h4
View original version evidence (126 explicit versions)
| Affected range | Recorded fix |
|---|---|
| Earlier releases through 2.0.2 (inclusive)Ecosystem versions | Not recorded |
Version evidence: OSV · GHSA-7gpv-xrjr-f5h4
View original version evidence (53 explicit versions)
Original source description
Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by a Path Traversal vulnerability when creating a store with child theme.Successful exploitation could lead to arbitrary file system write by an authenticated attacker. Access to the admin console is required for successful exploitation.