CVE-2025-49557: Adobe Commerce Stored XSS Vulnerability

CVE-2025-49557 Overview

CVE-2025-49557 is a stored Cross-Site Scripting (XSS) vulnerability affecting Adobe Commerce, Adobe Commerce B2B, and Magento Open Source. The flaw allows a low-privileged attacker to inject malicious scripts into vulnerable form fields. When a victim browses to a page rendering the injected payload, the script executes in their browser session. Adobe documented the issue in security bulletin APSB25-71 and classifies it under [CWE-79]. A successful exploit can lead to session takeover, with high impact on confidentiality and integrity. The scope is changed, meaning the injected script can affect resources beyond the vulnerable component's security boundary.

Critical Impact
Authenticated attackers with low privileges can inject persistent JavaScript into Adobe Commerce form fields, enabling session takeover of users (including administrators) who view the affected pages.

Affected Products

Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier
Adobe Commerce B2B versions 1.5.3-alpha1, 1.5.2-p1, 1.4.2-p6, 1.3.5-p11, 1.3.4-p13, 1.3.3-p14 and earlier
Magento Open Source 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13 and earlier

Discovery Timeline

2025-08-12 - CVE-2025-49557 published to NVD
2025-08-12 - Adobe publishes security advisory APSB25-71
2025-10-02 - Last updated in NVD database

Technical Details for CVE-2025-49557

Vulnerability Analysis

The vulnerability is a stored XSS flaw in Adobe Commerce input handling. An attacker authenticated with low privileges submits crafted input containing JavaScript through a vulnerable form field. The application persists the payload without sufficient output encoding or sanitization. When another user, often an administrator or customer service representative, renders the affected page, the browser executes the stored script in the user's session context. Because Adobe classifies the scope as changed, the executed script can act against resources outside the component that stored the payload. The most direct attack path is session hijacking using the victim's authentication cookies or token, followed by impersonation in the administrative or storefront context.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. Form fields accept user-controlled content that is later rendered without context-appropriate escaping. HTML, attribute, and JavaScript contexts each require distinct encoding, and a gap in any one of these enables stored XSS in Adobe Commerce templates.

Attack Vector

Exploitation is network-based and requires the attacker to hold a low-privileged account on the Commerce instance. The attacker submits a payload through a vulnerable form field. User interaction is required: a victim must browse to the page that renders the stored input. Once the page loads, the script runs with the victim's privileges, enabling cookie theft, request forgery against admin endpoints, or modification of catalog and order data.

No verified proof-of-concept code is published for this issue. Refer to the Adobe Security Advisory for Magento (APSB25-71) for technical details.

Detection Methods for CVE-2025-49557

Indicators of Compromise

Form field values in the Commerce database containing <script>, javascript:, onerror=, onload=, or encoded equivalents.
Unexpected outbound requests from admin or storefront sessions to attacker-controlled domains carrying cookies or session identifiers.
Admin user sessions created from unfamiliar IP addresses shortly after an authenticated admin viewed customer or catalog content.
New administrative accounts, role changes, or API keys created without a corresponding change-management record.

Detection Strategies

Inspect web server access logs for POST requests to Commerce form endpoints containing script tags or event handler attributes.
Query catalog, customer, and CMS tables for HTML or JavaScript syntax in fields that should hold plain text.
Deploy a Content Security Policy (CSP) in report-only mode to surface inline script execution on admin and storefront pages.
Monitor admin panel activity for impossible-travel logins and anomalous session reuse following XSS report findings.

Monitoring Recommendations

Centralize Commerce application, web server, and database audit logs and alert on payloads matching XSS signatures.
Track changes to high-value records (orders, customers, payment configuration) tied to admin sessions that recently viewed user-submitted content.
Enable file integrity monitoring on Magento template and JavaScript directories to identify follow-on tampering.

How to Mitigate CVE-2025-49557

Immediate Actions Required

Apply the Adobe security updates referenced in APSB25-71 to all Commerce, Commerce B2B, and Magento Open Source instances.
Inventory low-privileged accounts and revoke any that are unnecessary, stale, or shared.
Audit stored form field content for existing XSS payloads and sanitize or remove malicious entries.
Rotate admin session secrets, API tokens, and integration keys if compromise is suspected.

Patch Information

Adobe released fixed versions in security bulletin APSB25-71. Upgrade Adobe Commerce and Magento Open Source to the patched releases above 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, and 2.4.4-p14. Adobe Commerce B2B users must update to the corresponding patched B2B releases listed in the same advisory.

Workarounds

Restrict access to the Commerce admin panel using IP allow-lists, VPN, or zero-trust network access.
Place a Web Application Firewall in front of Commerce with rules that block common XSS payloads on form submissions.
Enforce a strict Content Security Policy that blocks inline scripts and disallows untrusted script sources for admin pages.
Require multi-factor authentication for all administrative and B2B accounts to limit the impact of stolen sessions.

bash

# Example CSP header for nginx fronting Adobe Commerce admin
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'; report-uri /csp-report" always;