CVE-2026-77110: Adobe Commerce Path Traversal Vulnerability

CVE-2026-77110 Overview

Adobe Commerce contains a path traversal vulnerability [CWE-22] that allows authenticated attackers with high privileges to bypass security features and access files outside intended directories. The flaw affects Adobe Commerce, Adobe Commerce B2B, and Magento Open Source across multiple versions from 2.4.4 through 2.4.9. Exploitation requires no user interaction and can be conducted over the network. Successful exploitation leads to unauthorized file access and limited availability disruption. The vulnerability has a changed scope, meaning impact extends beyond the vulnerable component.

Critical Impact
Attackers with high privileges can traverse restricted directories to access unauthorized files, bypass security controls, and cause limited availability disruption across affected Adobe Commerce deployments.

Affected Products

Adobe Commerce versions 2.4.4 through 2.4.9 (including all patch levels)
Adobe Commerce B2B versions 1.3.3 through 1.5.3
Adobe Magento Open Source versions 2.4.7 through 2.4.9

Discovery Timeline

2026-09-08 - CVE-2026-77110 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-77110

Vulnerability Analysis

The vulnerability originates from improper limitation of pathnames to restricted directories within Adobe Commerce. The application fails to properly sanitize or validate file path inputs supplied by authenticated administrative users. This deficiency allows attackers to construct paths containing directory traversal sequences that escape intended boundaries.

Because the CVSS scope is marked as changed, exploitation impacts resources beyond the vulnerable component's security authority. The confidentiality impact is rated none, while integrity impact is high and availability impact is low. This pattern suggests the flaw permits unauthorized modification or replacement of files that the application depends on for security enforcement, rather than raw file disclosure.

Root Cause

The root cause is insufficient input validation when Adobe Commerce processes file path parameters supplied through administrative functionality. Path components such as ../ sequences, encoded traversal patterns, or absolute path substitutions are not adequately filtered before use in file system operations. Attackers holding elevated privileges within the application can supply crafted path values that resolve to locations outside the intended restricted directory.

Attack Vector

Exploitation requires network access to the Adobe Commerce administrative interface and an authenticated account with high privileges. The attacker submits a request containing a manipulated path parameter to a vulnerable endpoint. The application then performs a file operation using the attacker-controlled path, bypassing the security feature that should restrict directory access. No user interaction is required, allowing scripted exploitation once valid administrative credentials are obtained through credential theft, insider access, or account compromise.

The vulnerability manifests when application logic processes file paths without canonicalization. Refer to the Adobe Security Advisory APSB26-138 for vendor-specific technical details.

Detection Methods for CVE-2026-77110

Indicators of Compromise

HTTP requests to Adobe Commerce administrative endpoints containing directory traversal sequences such as ../, ..\, or URL-encoded equivalents like %2e%2e%2f
Unexpected file modifications, deletions, or creations outside standard Magento application directories such as var/, pub/media/, and generated/
Administrative session activity from unusual IP addresses or geolocations preceding file system anomalies
Web server access logs showing successful authenticated requests with path parameters referencing sensitive configuration files like app/etc/env.php

Detection Strategies

Deploy web application firewall rules that inspect and block path traversal patterns targeting Magento admin routes
Monitor file integrity across the Adobe Commerce installation directory to identify unauthorized changes to configuration and code files
Review administrative audit logs for high-privilege accounts performing atypical file management operations
Correlate administrative authentication events with subsequent file system access anomalies through centralized logging

Monitoring Recommendations

Enable verbose logging on the Magento administrative interface and forward logs to a centralized SIEM for correlation
Alert on any HTTP request parameters containing path traversal indicators reaching Adobe Commerce endpoints
Track privileged user actions and flag deviations from normal administrative behavior patterns
Continuously validate the integrity of app/etc/env.php, .htaccess, and other security-relevant files

How to Mitigate CVE-2026-77110

Immediate Actions Required

Apply the security updates referenced in Adobe Security Advisory APSB26-138 to all affected Adobe Commerce, Commerce B2B, and Magento Open Source instances
Audit all administrative accounts and revoke privileges from accounts that no longer require elevated access
Enforce multi-factor authentication on all administrative accounts to reduce the risk of credential compromise
Review recent administrative activity logs for signs of exploitation attempts

Patch Information

Adobe released fixes for this vulnerability in security bulletin APSB26-138. Administrators must update to the patched versions specified in the advisory. Consult the Adobe Security Advisory APSB26-138 for exact patch versions corresponding to each affected release branch.

Workarounds

Restrict access to the Adobe Commerce administrative interface using IP allowlisting at the network or web server level
Implement web application firewall rules to filter path traversal patterns in HTTP request parameters
Reduce the number of accounts with administrative privileges to minimize the attack surface
Segment the Commerce application server from sensitive internal resources to contain potential impact

bash

# Example nginx configuration to block common path traversal patterns
location ~* /admin {
    if ($request_uri ~* "(\.\./|\.\.\\|%2e%2e%2f|%2e%2e/)") {
        return 403;
    }
    allow 10.0.0.0/8;
    deny all;
}