Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier contain an improper limitation of a pathname to a restricted directory (CWE-22) vulnerability. This path traversal flaw enables an authenticated attacker with administrative privileges to read or write files outside the restricted directory, potentially compromising system confidentiality and integrity. Exploitation does not require user interaction, and the scope change indicates the vulnerability crosses security boundaries. No vendor advisory or patch information is currently available to confirm remediation status.

An attacker with administrative privileges can exploit this vulnerability to access or modify files outside the intended restricted directory, leading to high impact on confidentiality and integrity of the system. Availability is not affected. The vulnerability could allow unauthorized disclosure or alteration of sensitive files within the Adobe Commerce environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit administrative access to trusted personnel only and monitor for suspicious activity related to file access. Do not assume the vulnerability is mitigated without vendor confirmation.