deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-3f97-7pgv-gmgr
Package: magento/community-edition (COMPOSER)
Severity: MODERATE (CVSS 6.5)
Vulnerable versions: = 2.4.2
Patched in: unpatched

Summary: Magento affected by a business logic error in the placeOrder graphql mutation

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a business logic error in the placeOrder graphql mutation. An authenticated attacker can leverage this vulnerability to altar the price of an item.
GitHub Security Advisory: GHSA-3f97-7pgv-gmgr
Package: magento/community-edition (COMPOSER)
Severity: MODERATE (CVSS 6.5)
Vulnerable versions: >= 2.4.2-p1, < 2.4.2-p2
Patched in: 2.4.2-p2

Summary: Magento affected by a business logic error in the placeOrder graphql mutation

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a business logic error in the placeOrder graphql mutation. An authenticated attacker can leverage this vulnerability to altar the price of an item.
GitHub Security Advisory: GHSA-3f97-7pgv-gmgr
Package: magento/community-edition (COMPOSER)
Severity: MODERATE (CVSS 6.5)
Vulnerable versions: = 2.3.7
Patched in: unpatched

Summary: Magento affected by a business logic error in the placeOrder graphql mutation

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a business logic error in the placeOrder graphql mutation. An authenticated attacker can leverage this vulnerability to altar the price of an item.
GitHub Security Advisory: GHSA-3f97-7pgv-gmgr
Package: magento/community-edition (COMPOSER)
Severity: MODERATE (CVSS 6.5)
Vulnerable versions: < 2.3.7-p1
Patched in: 2.3.7-p1

Summary: Magento affected by a business logic error in the placeOrder graphql mutation

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a business logic error in the placeOrder graphql mutation. An authenticated attacker can leverage this vulnerability to altar the price of an item.
GitHub Security Advisory: GHSA-3f97-7pgv-gmgr
Package: magento/project-community-edition (COMPOSER)
Severity: MODERATE (CVSS 6.5)
Vulnerable versions: <= 2.0.2
Patched in: unpatched

Summary: Magento affected by a business logic error in the placeOrder graphql mutation

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a business logic error in the placeOrder graphql mutation. An authenticated attacker can leverage this vulnerability to altar the price of an item.
GitHub Security Advisory: GHSA-8cjg-f53m-8m9q
Package: magento/community-edition (COMPOSER)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vulnerable versions: = 2.4.2
Patched in: unpatched

Summary: Magento XML Injection vulnerability in the Widgets Update Layout

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the Widgets Update Layout. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution.
GitHub Security Advisory: GHSA-8cjg-f53m-8m9q
Package: magento/community-edition (COMPOSER)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vulnerable versions: >= 2.4.2-p1, < 2.4.2-p2
Patched in: 2.4.2-p2

Summary: Magento XML Injection vulnerability in the Widgets Update Layout

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the Widgets Update Layout. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution.
GitHub Security Advisory: GHSA-8cjg-f53m-8m9q
Package: magento/community-edition (COMPOSER)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vulnerable versions: = 2.3.7
Patched in: unpatched

Summary: Magento XML Injection vulnerability in the Widgets Update Layout

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the Widgets Update Layout. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution.
GitHub Security Advisory: GHSA-8cjg-f53m-8m9q
Package: magento/community-edition (COMPOSER)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vulnerable versions: < 2.3.7-p1
Patched in: 2.3.7-p1

Summary: Magento XML Injection vulnerability in the Widgets Update Layout

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the Widgets Update Layout. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution.
GitHub Security Advisory: GHSA-8cjg-f53m-8m9q
Package: magento/project-community-edition (COMPOSER)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vulnerable versions: <= 2.0.2
Patched in: unpatched

Summary: Magento XML Injection vulnerability in the Widgets Update Layout

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the Widgets Update Layout. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution.
GitHub Security Advisory: GHSA-wqr6-wv6c-p8fx
Package: magento/community-edition (COMPOSER)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-284: Improper Access Control
Vulnerable versions: = 2.4.2
Patched in: unpatched

Summary: Magento improper access control vulnerability within Magento's Media Gallery Upload workflow

Details:
Magento versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper access control vulnerability within Magento's Media Gallery Upload workflow. By storing a specially crafted file in the website gallery, an authenticated attacker with administrative privilege can gain access to delete the .htaccess file. This could result in the attacker achieving remote code execution.
GitHub Security Advisory: GHSA-wqr6-wv6c-p8fx
Package: magento/community-edition (COMPOSER)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-284: Improper Access Control
Vulnerable versions: >= 2.4.2-p1, < 2.4.2-p2
Patched in: 2.4.2-p2

Summary: Magento improper access control vulnerability within Magento's Media Gallery Upload workflow

Details:
Magento versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper access control vulnerability within Magento's Media Gallery Upload workflow. By storing a specially crafted file in the website gallery, an authenticated attacker with administrative privilege can gain access to delete the .htaccess file. This could result in the attacker achieving remote code execution.
GitHub Security Advisory: GHSA-wqr6-wv6c-p8fx
Package: magento/community-edition (COMPOSER)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-284: Improper Access Control
Vulnerable versions: = 2.3.7
Patched in: unpatched

Summary: Magento improper access control vulnerability within Magento's Media Gallery Upload workflow

Details:
Magento versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper access control vulnerability within Magento's Media Gallery Upload workflow. By storing a specially crafted file in the website gallery, an authenticated attacker with administrative privilege can gain access to delete the .htaccess file. This could result in the attacker achieving remote code execution.
GitHub Security Advisory: GHSA-wqr6-wv6c-p8fx
Package: magento/community-edition (COMPOSER)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-284: Improper Access Control
Vulnerable versions: < 2.3.7-p1
Patched in: 2.3.7-p1

Summary: Magento improper access control vulnerability within Magento's Media Gallery Upload workflow

Details:
Magento versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper access control vulnerability within Magento's Media Gallery Upload workflow. By storing a specially crafted file in the website gallery, an authenticated attacker with administrative privilege can gain access to delete the .htaccess file. This could result in the attacker achieving remote code execution.
GitHub Security Advisory: GHSA-wqr6-wv6c-p8fx
Package: magento/project-community-edition (COMPOSER)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-284: Improper Access Control
Vulnerable versions: <= 2.0.2
Patched in: unpatched

Summary: Magento improper access control vulnerability within Magento's Media Gallery Upload workflow

Details:
Magento versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper access control vulnerability within Magento's Media Gallery Upload workflow. By storing a specially crafted file in the website gallery, an authenticated attacker with administrative privilege can gain access to delete the .htaccess file. This could result in the attacker achieving remote code execution.
GitHub Security Advisory: GHSA-4g27-q2w9-m8m8
Package: magento/community-edition (COMPOSER)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: = 2.4.2
Patched in: unpatched

Summary: Magento affected by remote code execution vulnerability in the CMS page scheduled update feature

Details:
Magento versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an Improper input validation vulnerability within the CMS page scheduled update feature. An authenticated attacker with administrative privilege could leverage this vulnerability to achieve remote code execution on the system.
GitHub Security Advisory: GHSA-4g27-q2w9-m8m8
Package: magento/community-edition (COMPOSER)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 2.4.2-p1, < 2.4.2-p2
Patched in: 2.4.2-p2

Summary: Magento affected by remote code execution vulnerability in the CMS page scheduled update feature

Details:
Magento versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an Improper input validation vulnerability within the CMS page scheduled update feature. An authenticated attacker with administrative privilege could leverage this vulnerability to achieve remote code execution on the system.
GitHub Security Advisory: GHSA-4g27-q2w9-m8m8
Package: magento/community-edition (COMPOSER)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: = 2.3.7
Patched in: unpatched

Summary: Magento affected by remote code execution vulnerability in the CMS page scheduled update feature

Details:
Magento versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an Improper input validation vulnerability within the CMS page scheduled update feature. An authenticated attacker with administrative privilege could leverage this vulnerability to achieve remote code execution on the system.
GitHub Security Advisory: GHSA-4g27-q2w9-m8m8
Package: magento/community-edition (COMPOSER)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: < 2.3.7-p1
Patched in: 2.3.7-p1

Summary: Magento affected by remote code execution vulnerability in the CMS page scheduled update feature

Details:
Magento versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an Improper input validation vulnerability within the CMS page scheduled update feature. An authenticated attacker with administrative privilege could leverage this vulnerability to achieve remote code execution on the system.
GitHub Security Advisory: GHSA-4g27-q2w9-m8m8
Package: magento/project-community-edition (COMPOSER)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: <= 2.0.2
Patched in: unpatched

Summary: Magento affected by remote code execution vulnerability in the CMS page scheduled update feature

Details:
Magento versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an Improper input validation vulnerability within the CMS page scheduled update feature. An authenticated attacker with administrative privilege could leverage this vulnerability to achieve remote code execution on the system.
GitHub Security Advisory: GHSA-52fg-wjxm-pp44
Package: magento/community-edition (COMPOSER)
Severity: HIGH (CVSS 8.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: = 2.4.4
Patched in: unpatched

Summary: Magento DOM-based Cross-Site Scripting (XSS) vulnerability

Details:
Magento versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. This vulnerability could allow an admin attacker to inject and execute arbitrary JavaScript code within the context of the user's browser session. Exploitation of this issue requires user interaction, such as convincing a victim to click on a malicious link. Confidentiality and integrity impact is high as it affects other admin accounts.
GitHub Security Advisory: GHSA-52fg-wjxm-pp44
Package: magento/community-edition (COMPOSER)
Severity: HIGH (CVSS 8.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: = 2.4.5
Patched in: unpatched

Summary: Magento DOM-based Cross-Site Scripting (XSS) vulnerability

Details:
Magento versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. This vulnerability could allow an admin attacker to inject and execute arbitrary JavaScript code within the context of the user's browser session. Exploitation of this issue requires user interaction, such as convincing a victim to click on a malicious link. Confidentiality and integrity impact is high as it affects other admin accounts.
GitHub Security Advisory: GHSA-52fg-wjxm-pp44
Package: magento/community-edition (COMPOSER)
Severity: HIGH (CVSS 8.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: = 2.4.6
Patched in: unpatched

Summary: Magento DOM-based Cross-Site Scripting (XSS) vulnerability

Details:
Magento versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. This vulnerability could allow an admin attacker to inject and execute arbitrary JavaScript code within the context of the user's browser session. Exploitation of this issue requires user interaction, such as convincing a victim to click on a malicious link. Confidentiality and integrity impact is high as it affects other admin accounts.
GitHub Security Advisory: GHSA-52fg-wjxm-pp44
Package: magento/community-edition (COMPOSER)
Severity: HIGH (CVSS 8.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: = 2.4.7
Patched in: unpatched

Summary: Magento DOM-based Cross-Site Scripting (XSS) vulnerability

Details:
Magento versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. This vulnerability could allow an admin attacker to inject and execute arbitrary JavaScript code within the context of the user's browser session. Exploitation of this issue requires user interaction, such as convincing a victim to click on a malicious link. Confidentiality and integrity impact is high as it affects other admin accounts.
GitHub Security Advisory: GHSA-52fg-wjxm-pp44
Package: magento/community-edition (COMPOSER)
Severity: HIGH (CVSS 8.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 2.4.4-p1, < 2.4.4-p10
Patched in: 2.4.4-p10

Summary: Magento DOM-based Cross-Site Scripting (XSS) vulnerability

Details:
Magento versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. This vulnerability could allow an admin attacker to inject and execute arbitrary JavaScript code within the context of the user's browser session. Exploitation of this issue requires user interaction, such as convincing a victim to click on a malicious link. Confidentiality and integrity impact is high as it affects other admin accounts.
GitHub Security Advisory: GHSA-52fg-wjxm-pp44
Package: magento/community-edition (COMPOSER)
Severity: HIGH (CVSS 8.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 2.4.5-p1, < 2.4.5-p9
Patched in: 2.4.5-p9

Summary: Magento DOM-based Cross-Site Scripting (XSS) vulnerability

Details:
Magento versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. This vulnerability could allow an admin attacker to inject and execute arbitrary JavaScript code within the context of the user's browser session. Exploitation of this issue requires user interaction, such as convincing a victim to click on a malicious link. Confidentiality and integrity impact is high as it affects other admin accounts.
GitHub Security Advisory: GHSA-52fg-wjxm-pp44
Package: magento/community-edition (COMPOSER)
Severity: HIGH (CVSS 8.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 2.4.6-p1, < 2.4.6-p7
Patched in: 2.4.6-p7

Summary: Magento DOM-based Cross-Site Scripting (XSS) vulnerability

Details:
Magento versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. This vulnerability could allow an admin attacker to inject and execute arbitrary JavaScript code within the context of the user's browser session. Exploitation of this issue requires user interaction, such as convincing a victim to click on a malicious link. Confidentiality and integrity impact is high as it affects other admin accounts.
GitHub Security Advisory: GHSA-52fg-wjxm-pp44
Package: magento/community-edition (COMPOSER)
Severity: HIGH (CVSS 8.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 2.4.7-beta1, < 2.4.7-p2
Patched in: 2.4.7-p2

Summary: Magento DOM-based Cross-Site Scripting (XSS) vulnerability

Details:
Magento versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. This vulnerability could allow an admin attacker to inject and execute arbitrary JavaScript code within the context of the user's browser session. Exploitation of this issue requires user interaction, such as convincing a victim to click on a malicious link. Confidentiality and integrity impact is high as it affects other admin accounts.
GitHub Security Advisory: GHSA-52fg-wjxm-pp44
Package: magento/project-community-edition (COMPOSER)
Severity: HIGH (CVSS 8.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: <= 2.0.2
Patched in: unpatched

Summary: Magento DOM-based Cross-Site Scripting (XSS) vulnerability

Details:
Magento versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. This vulnerability could allow an admin attacker to inject and execute arbitrary JavaScript code within the context of the user's browser session. Exploitation of this issue requires user interaction, such as convincing a victim to click on a malicious link. Confidentiality and integrity impact is high as it affects other admin accounts.
GitHub Security Advisory: GHSA-7r99-8wqp-h7pc
Package: magento/community-edition (COMPOSER)
Severity: HIGH (CVSS 7.7)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: = 2.4.4
Patched in: unpatched

Summary: Magento Path Traversal vulnerability

Details:
Magento versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. A low-privileged attacker could exploit this vulnerability to gain access to files and directories that are outside the restricted directory. Exploitation of this issue does not require user interaction and scope is changed.
GitHub Security Advisory: GHSA-7r99-8wqp-h7pc
Package: magento/community-edition (COMPOSER)
Severity: HIGH (CVSS 7.7)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: = 2.4.5
Patched in: unpatched

Summary: Magento Path Traversal vulnerability

Details:
Magento versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. A low-privileged attacker could exploit this vulnerability to gain access to files and directories that are outside the restricted directory. Exploitation of this issue does not require user interaction and scope is changed.
GitHub Security Advisory: GHSA-7r99-8wqp-h7pc
Package: magento/community-edition (COMPOSER)
Severity: HIGH (CVSS 7.7)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: = 2.4.6
Patched in: unpatched

Summary: Magento Path Traversal vulnerability

Details:
Magento versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. A low-privileged attacker could exploit this vulnerability to gain access to files and directories that are outside the restricted directory. Exploitation of this issue does not require user interaction and scope is changed.
GitHub Security Advisory: GHSA-7r99-8wqp-h7pc
Package: magento/community-edition (COMPOSER)
Severity: HIGH (CVSS 7.7)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: = 2.4.7
Patched in: unpatched

Summary: Magento Path Traversal vulnerability

Details:
Magento versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. A low-privileged attacker could exploit this vulnerability to gain access to files and directories that are outside the restricted directory. Exploitation of this issue does not require user interaction and scope is changed.
GitHub Security Advisory: GHSA-7r99-8wqp-h7pc
Package: magento/community-edition (COMPOSER)
Severity: HIGH (CVSS 7.7)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: >= 2.4.4-p1, < 2.4.4-p10
Patched in: 2.4.4-p10

Summary: Magento Path Traversal vulnerability

Details:
Magento versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. A low-privileged attacker could exploit this vulnerability to gain access to files and directories that are outside the restricted directory. Exploitation of this issue does not require user interaction and scope is changed.