CVE-2026-34653: Adobe Commerce Path Traversal Vulnerability

CVE-2026-34653 Overview

CVE-2026-34653 is a path traversal vulnerability affecting Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier. The flaw is classified as Improper Limitation of a Pathname to a Restricted Directory [CWE-22]. An authenticated attacker with administrative privileges can read and write arbitrary files outside the restricted directory. Exploitation does not require user interaction, and the vulnerability has a changed scope, meaning impact extends beyond the vulnerable component.

Critical Impact
Authenticated administrators can read and write arbitrary files on the underlying file system, leading to potential code execution paths, configuration tampering, and disclosure of sensitive store data.

Affected Products

Adobe Commerce 2.4.9-beta1
Adobe Commerce 2.4.8-p4, 2.4.7-p9, 2.4.6-p14
Adobe Commerce 2.4.5-p16, 2.4.4-p17 and earlier

Discovery Timeline

2026-05-12 - CVE CVE-2026-34653 published to NVD
2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-34653

Vulnerability Analysis

The vulnerability resides in file-handling logic within the Adobe Commerce administrative interface. Input parameters that resolve to file system paths are not properly normalized or constrained. An attacker submits crafted path components such as ../ sequences or absolute paths through admin-exposed functionality. The server then resolves the supplied path outside the intended restricted directory.

Because scope is changed, exploitation affects resources beyond the Commerce application boundary. An attacker can target configuration files, credentials, cron scripts, or extension code paths. Writing attacker-controlled content to executable locations creates a path toward arbitrary code execution as the web server user.

Root Cause

The root cause is insufficient validation of pathname inputs supplied to administrative file operations. The application accepts user-supplied path fragments and concatenates them with base directories without canonicalization. Standard mitigations such as realpath() checks and allowlist-based directory enforcement are missing or bypassable in the affected releases.

Attack Vector

The attack vector is network-based and requires authentication with administrative privileges. An attacker who has obtained admin credentials, hijacked an admin session, or compromised an admin account through phishing can trigger the flaw. The attacker sends crafted requests to vulnerable admin endpoints with path traversal payloads. No user interaction is required to complete exploitation. See the Adobe Security Advisory APSB26-49 for technical details.

Detection Methods for CVE-2026-34653

Indicators of Compromise

Admin access log entries containing path traversal sequences such as ../, ..%2f, or absolute paths in request parameters
Unexpected file modifications outside the Commerce pub/ and var/ directories
New or modified PHP files in unusual paths or write activity from the web server user to system directories
Anomalous administrator session activity that precedes file system changes

Detection Strategies

Inspect HTTP request logs for traversal patterns targeting admin routes and file upload or media management endpoints
Correlate admin login events with subsequent file system writes by the web server process
Hash and baseline Commerce application files, then alert on drift outside scheduled deployments

Monitoring Recommendations

Forward web server, PHP-FPM, and audit logs to a centralized analytics platform for traversal pattern queries
Monitor admin user creation, privilege changes, and source IP anomalies for compromised credentials
Enable file integrity monitoring on core Commerce directories and the underlying operating system

How to Mitigate CVE-2026-34653

Immediate Actions Required

Apply the patches referenced in Adobe Security Advisory APSB26-49 to all Adobe Commerce instances
Audit administrator accounts and rotate credentials for any admin user whose activity cannot be verified
Restrict access to the /admin interface using IP allowlists, VPN, or reverse proxy authentication
Enforce multi-factor authentication for all administrative accounts

Patch Information

Adobe has released fixed versions addressed in Adobe Security Advisory APSB26-49. Upgrade to the latest patched release for your version branch. Verify the deployment after patching by reviewing version output and applying any required schema or configuration updates.

Workarounds

Limit administrative panel exposure to trusted networks only until patches are applied
Reduce the number of accounts holding the administrator role and review their activity
Deploy a web application firewall rule that blocks traversal sequences on admin endpoints

bash

# Example WAF rule concept to block traversal payloads on admin paths
# (adapt to your WAF syntax)
SecRule REQUEST_URI "@beginsWith /admin" \
  "chain,deny,status:403,id:1026034653,msg:'Block path traversal on Commerce admin'"
  SecRule ARGS|REQUEST_URI "@rx (\.\./|\.\.\\|%2e%2e%2f|%2e%2e/)" "t:lowercase"