Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier contain an improper limitation of a pathname to a restricted directory (CWE-22) vulnerability. This path traversal flaw allows an authenticated attacker with administrative privileges to read or write arbitrary files outside the restricted directory scope. Exploitation does not require user interaction and changes the scope of the attack. The vulnerability has a CVSS v3.1 base score of 8.7 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N), reflecting network attack vector, low attack complexity, high privileges required, no user interaction, changed scope, and high impact on confidentiality and integrity.

Successful exploitation allows an attacker with administrative privileges to read and write arbitrary files outside the intended restricted directories, potentially leading to disclosure or modification of sensitive data. The vulnerability affects confidentiality and integrity but does not impact availability. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrative access to trusted personnel only and monitor for suspicious activity related to file system access. Avoid exposing administrative interfaces to untrusted networks.