CVE-2025-49559: Adobe Commerce Path Traversal Vulnerability

CVE-2025-49559 Overview

CVE-2025-49559 is a path traversal vulnerability affecting Adobe Commerce, Adobe Magento Open Source, and Adobe Commerce B2B. The flaw stems from an Improper Limitation of a Pathname to a Restricted Directory [CWE-22]. An attacker can leverage the vulnerability to bypass a security feature and modify limited data. Exploitation requires no user interaction and no prior authentication. Adobe published the fix in security advisory APSB25-71 on August 12, 2025.

Critical Impact
Remote attackers can bypass security controls in Adobe Commerce storefronts to modify limited data without authentication or user interaction, potentially affecting merchant catalog and configuration integrity.

Affected Products

Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier
Adobe Magento Open Source (same version ranges as Adobe Commerce)
Adobe Commerce B2B versions 1.5.3-alpha1, 1.5.2-p1, 1.4.2-p6, 1.3.5-p11, 1.3.4-p13, 1.3.3-p14 and earlier

Discovery Timeline

2025-08-12 - CVE CVE-2025-49559 published to NVD
2025-08-12 - Adobe releases security advisory APSB25-71
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-49559

Vulnerability Analysis

The vulnerability is a path traversal issue [CWE-22] in Adobe Commerce and Magento Open Source. The application fails to properly sanitize user-supplied pathname components before using them to resolve resources on the filesystem or within a restricted logical directory. As a result, an unauthenticated remote attacker can craft a request that escapes the intended directory boundary. The outcome is a security feature bypass rather than a full read or write compromise. Adobe classifies the integrity impact as limited, meaning the attacker can modify a bounded subset of data exposed by the affected code path.

Root Cause

The root cause is insufficient input validation on pathname or resource-identifier parameters processed by Adobe Commerce. The affected component accepts input that may contain directory traversal sequences such as ../ or encoded equivalents. Because the pathname is not canonicalized and validated against a permitted base directory before use, the application resolves paths outside the intended scope. This weakness allows the attacker to reach code paths or resources that a security check would otherwise protect.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends a specially crafted HTTP request to an exposed Adobe Commerce endpoint. The request contains traversal sequences within a parameter that the application treats as a path or resource identifier. Because the vulnerability yields a security feature bypass with limited integrity impact, exploitation is most useful as a chained primitive against internal controls rather than as a standalone data-theft technique. No public proof-of-concept exploit is currently available, and the flaw is not listed in the CISA KEV catalog.

No verified public exploit code exists for CVE-2025-49559. Refer to the Adobe Security Advisory APSB25-71 for vendor-supplied technical detail.

Detection Methods for CVE-2025-49559

Indicators of Compromise

HTTP requests to Adobe Commerce endpoints containing traversal sequences such as ../, ..\, %2e%2e%2f, or double-encoded variants in path or query parameters.
Unexpected modifications to configuration entities, catalog metadata, or restricted resources without a corresponding authenticated admin session in the Magento audit trail.
Access log entries showing anonymous requests to storefront controllers immediately followed by state changes on protected objects.

Detection Strategies

Deploy web application firewall (WAF) rules that identify path traversal patterns in request URIs, POST bodies, and REST or GraphQL parameters targeting /rest/, /graphql, and storefront routes.
Correlate Magento application logs with web server access logs to surface unauthenticated requests that produce write operations on restricted entities.
Baseline normal parameter shapes for Commerce API endpoints and alert on deviations that include encoded traversal tokens.

Monitoring Recommendations

Enable verbose logging on var/log/exception.log and var/log/system.log and forward events to a centralized log platform for retention and correlation.
Monitor filesystem integrity for Magento core directories (app/etc/, pub/media/, var/) and alert on writes originating from the PHP-FPM worker without an associated admin session identifier.
Track outbound anomalies from the Commerce host that could indicate follow-on activity after a security control bypass.

How to Mitigate CVE-2025-49559

Immediate Actions Required

Apply the patches referenced in Adobe Security Advisory APSB25-71 to all Adobe Commerce, Magento Open Source, and Commerce B2B instances.
Inventory all internet-facing Commerce deployments and verify the running version against the fixed release table published by Adobe.
Review web server and application logs for the past 90 days for traversal patterns targeting Commerce endpoints.

Patch Information

Adobe addressed CVE-2025-49559 in the security update released on August 12, 2025. Administrators should upgrade to the fixed versions listed in APSB25-71, which supersede 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, and 2.4.4-p14. Adobe Commerce B2B customers must upgrade the B2B module to the corresponding fixed release in addition to the core Commerce patch.

Workarounds

Deploy WAF signatures that block traversal sequences (../, ..\, %2e%2e%2f, %252e%252e%252f) in request paths and parameters routed to Adobe Commerce.
Restrict administrative and API endpoints to trusted networks using IP allowlisting at the reverse proxy or load balancer.
Enforce least privilege on the PHP-FPM service account so filesystem writes are limited to directories required for Commerce operation.

bash

# Example nginx rule to block path traversal patterns in requests to Adobe Commerce
location ~ ^/(rest|graphql|index.php) {
    if ($request_uri ~* "(\.\./|\.\.\\|%2e%2e%2f|%252e%252e%252f)") {
        return 403;
    }
    include fastcgi_params;
    fastcgi_pass unix:/var/run/php-fpm.sock;
}