PT-2026-40398 · Adobe · Commerce

Miklos Zoltan · CVE-2026-34653 · Published 2026-05-12 · Updated 2026-05-12

Positive Technologies (AI Summary)

CVSS v3.1

8.7

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Adobe Commerce versions prior to 2.4.9-beta1

Description An improper limitation of a pathname to a restricted directory, known as path traversal, allows an authenticated attacker with administrative privileges to read and write arbitrary files outside the intended directory. This issue does not require user interaction.

Recommendations Update to a version newer than 2.4.9-beta1.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2026-06644

CVE-2026-34653

Affected Products

Commerce

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34653.json · Exploit
• https://helpx.adobe.com/security/products/magento/apsb26-49.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34653 · Security Note
• https://osv.dev/vulnerability/CVE-2026-34653 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-06644 · Security Note
• https://twitter.com/CVEnew/status/2054324061644403127 · Twitter Post
• https://twitter.com/KaitanSecurity/status/2054343410081792024 · Twitter Post