Adobe Commerce | Improper Input Validation (CWE-20)

Summary

Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by an Improper Input Validation vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability by providing specially crafted input, causing the application to crash or become unresponsive. Exploitation of this issue does not require user interaction.

Timeline

1. Aug 12, 2025, 5:55 PM UTCCVE published
2. Aug 13, 2025, 2:18 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: yes · Technical impact: partial

3. Aug 13, 2025, 8:14 PM UTCRecord last updated

Affected versions

• Adobe Adobe Commerce

  through 2.4.4-p14

• magento/project-community-editionPackagist

  through 2.0.2

• magento/community-editionPackagist

  From 2.4.9-alpha1 · fixed in 2.4.9-alpha2

• magento/community-editionPackagist

  From 2.4.8-beta1 · fixed in 2.4.8-p2

• magento/community-editionPackagist

  From 2.4.7-beta1 · fixed in 2.4.7-p7

• magento/community-editionPackagist

  From 2.4.6-p1 · fixed in 2.4.6-p12

• magento/community-editionPackagist

  fixed in 2.4.5-p14

• magento/community-editionPackagist

  2.4.5

• magento/community-editionPackagist

  2.4.6

• magento/community-editionPackagist

  2.4.7

• magento/community-editionPackagist

  2.4.8

References 1