CVE-2026-77110: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in Adobe Adobe Commerce

CVE-2026-77110 is an improper limitation of a pathname to a restricted directory vulnerability in Adobe Commerce. It enables an attacker with elevated privileges to perform a path traversal attack, bypassing security controls to access files or directories outside the restricted boundaries. The vulnerability impacts confidentiality and integrity by allowing unauthorized file access and causes limited availability disruption. Exploitation does not require user interaction, and the scope of the vulnerability is changed. The CVSS 3.1 base score is 7.6 (AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:L).

An attacker with high privileges can bypass security restrictions to access unauthorized files or directories, potentially leading to integrity violations and limited availability disruption. Confidentiality impact is not indicated. The vulnerability does not require user interaction and changes the security scope.

No patch or official fix information is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict high privilege access and monitor for suspicious activity related to unauthorized file access.