voxell vciy

CVE-2024-39406: Adobe Commerce | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

ROUTINE

Telemetry drift only. No threshold crossed and no authority ruling changed.

CVE record, CISA KEV and EPSS as of 2026-10-18.

What to do now held facts and links

No fix version is held. The CNA's first reference is the place to look: helpx.adobe.com
Record your decision, dated and frozen with today's evidence: patch by a date · mitigated by a compensating control · deferred · accepted the risk · not affected
Check your version against the ranges this record publishes.

What it is stated by the CNA

Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An admin attacker could exploit this vulnerability to gain access to files and directories that are outside the restricted directory. Exploitation of this issue does not require user interaction and scope is changed.

weakness: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
affected: Adobe Commerce
published ranges: adobe commerce <= 2.4.3; adobe commerce 2.4.4; adobe commerce 2.4.4-p1; adobe commerce 2.4.4-p2; and 58 more on the CVE page
fixed in: No fix version in held sources.
fixed by package (from OSV advisories): magento/community-edition (Packagist): 2.4.4-p10; 2.4.5-p9; 2.4.6-p7; 2.4.7-p2 GHSA-6pxh-2557-5cj5
later fixes (from OSV advisories): magento/community-edition 2.4.4-p10 is inside a range CVE-2022-34253 (GHSA-cj7w-pm77-hvg6) lists as affected. That advisory is fixed in 2.4.5.magento/community-edition 2.4.4-p10 is inside a range CVE-2022-34254 (GHSA-fx9g-g9q6-x3jx) lists as affected. That advisory is fixed in 2.4.5.magento/community-edition 2.4.4-p10 is inside a range CVE-2022-34255 (GHSA-x95x-f4g9-mm85) lists as affected. That advisory is fixed in 2.4.5.magento/community-edition 2.4.4-p10 is inside a range CVE-2022-34256 (GHSA-r7mm-grf3-5fjv) lists as affected. That advisory is fixed in 2.4.5.magento/community-edition 2.4.4-p10 is inside a range CVE-2022-34257 (GHSA-rg7p-wmgj-f374) lists as affected. That advisory is fixed in 2.4.5.magento/community-edition 2.4.4-p10 is inside a range CVE-2022-34258 (GHSA-5m55-g8pv-x8ww) lists as affected. That advisory is fixed in 2.4.5.
severity: 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
assigned by: adobe
published: 2024-08-14

check us helpx.adobe.com

Exploit code held, dated

exploit code: None held in the PoC-in-GitHub feed. A public repository changes this brief.

What moved held, dated

date	EPSS	event
15 Aug 2024	0.00053
15 Sep 2024	0.0005
17 Oct 2024	0.00063
17 Mar 2025	0.00307	scoring model v2025.03.14
18 Apr 2026	0.00707
26 Apr 2026	0.00681
1 May 2026	0.00916
15 Jun 2026	0.00872	scoring model v2026.06.15

23 observations held. A step marked with a scoring model moved because the measurement was replaced, not because the vulnerability changed.

Outside the record researched, cited

This section reads the record's references and adds cited findings from outside it. It needs an account. Everything above is held facts and is complete without it.

What would change this brief held, dated

CISA KEV: Not listed in the catalogue we hold. A listing changes this brief.
exploit probability: 0.01 on 2026-06-15 (FIRST's EPSS, a probability and not evidence of exploitation). Next band line: 10% (0.10). Crossing a line changes this brief.
fix: No fix version is held. One published by the CNA or OSV changes this brief.

Watch this CVE What counts as a move

How to check this

Every value above is held with two dates: when it was true upstream (as_of) and when we recorded it (tx_from). Re-derive the exploit probability as it stood on any date:

SELECT value, source, source_version, as_of, tx_from
FROM volatile_valid_as_of('CVE-2024-39406', '2026-11-01T23:59:59.999999Z', now());