CVE-2021-28584: 
PHP vulnerability analysis and mitigation

A Path Traversal vulnerability (CVE-2021-28584) was identified in Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier), and 2.3.6-p1 (and earlier). The vulnerability was discovered and assigned on March 16, 2021, affecting both Magento Commerce and Open Source editions (CVE MITRE).

The vulnerability is classified as a Path Traversal issue (CWE-22) that occurs when creating a store with a child theme. The severity assessment varies, with NVD assigning a CVSS v3.1 Base Score of 7.2 (HIGH) with vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, while Adobe Systems Incorporated rated it as MEDIUM with a score of 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) (NVD).

Successful exploitation of this vulnerability could lead to arbitrary file system write capabilities on the affected system. The impact is somewhat limited as it requires authentication and access to the admin console for successful exploitation (CVE MITRE).

Adobe has released security patches to address this vulnerability through their security advisory. Users are advised to update to the latest version of Magento that includes these security fixes (Adobe Advisory).