CVE-2025-49559: 
PHP vulnerability analysis and mitigation

Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability identified as CVE-2025-49559. The vulnerability was disclosed on August 12, 2025, and received its initial analysis from NIST on August 15, 2025 (NVD).

The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and has received a CVSS 3.1 Base Score of 5.3 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. This indicates that the vulnerability is network-accessible, requires low attack complexity, needs no privileges or user interaction, and can result in low-impact data modification (NVD).

The vulnerability could result in a security feature bypass, allowing an attacker to modify limited data. The exploitation does not require user interaction, making it particularly concerning for exposed systems (NVD).

The vulnerability can be exploited without requiring user interaction or authentication. It is network-accessible with low attack complexity, making it relatively straightforward to exploit (NVD).