Sign in
Deutsch English Español Polski
Critical

Magento 2 Community Edition RCE via Unsafe File Upload

  • Disclosed: 24.05.2022
  • Updated: 11.10.2026 12:17

Magento versions 2.4.0 and 2.3.5p1 (and earlier) are affected by an unsafe file upload vulnerability that could result in arbitrary code execution. This vulnerability could be abused by authenticated users with administrative permissions to the System/Data and Transfer/Import components.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Composer package magento/community-edition < 2.4.1 2.4.1
Composer package magento/project-community-edition <= 2.0.2 no fix
Magento (core) magento/community-edition < 2.4.1, <= 2.0.2 2.4.1

References

CVSS score 9.1/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Weakness (CWE)
CWE-434
Platform
Composer, Magento
Package
magento/community-edition, magento/project-community-edition
Disclosed
24.05.2022
Updated
11.10.2026 12:17

Sources and licenses

OSV / GitHub Advisory Database - GHSA-7pxg-6p87-8c9v - CC BY 4.0

Vulnerability history: magento/project-community-edition

All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (161) in the archive
Total entries
161
First → latest
11.2019 10.2025
Without a fix
160
Exploited in attacks
1

Severity breakdown

  • Critical 24
  • High 48
  • Medium 77
  • Low 12

Disclosures per year

Severity:
  1. Magento vulnerable to stored Cross-Site Scripting (XSS)
    High · 8.1 CVE-2025-54264 <= 2.0.2 no fix
  2. Magento provides incorrect authorization through a security feature bypass
    High · 8.1 CVE-2025-54263 <= 2.0.2 no fix
  3. Magento Community Edition Improper Input Validation vulnerability
    Critical · 9.1 Exploited in attacks CVE-2025-54236 <= 2.0.2 no fix
  4. Magento Cross-Site Request Forgery (CSRF) vulnerability
    High · 8.1 CVE-2025-49555 <= 2.0.2 no fix
  5. Magento vulnerable to denial of service
    High · 7.5 CVE-2025-49554 <= 2.0.2 no fix
  6. Magento has incorrect authorization issue that leads to arbitrary file system read
    High · 7.5 CVE-2025-49556 <= 2.0.2 no fix
  7. Magento Cross-site Scripting vulnerability
    High · 8.7 CVE-2025-49557 <= 2.0.2 no fix
  8. Magento Improper Authorization leading to security feature bypass
    High · 8.2 CVE-2025-43585 <= 2.0.2 no fix
  9. Improper Authorization vulnerability in Magento and Adobe Commerce
    Critical · 9.1 CVE-2025-24434 <= 2.0.2 no fix
  10. Magento stored Cross-Site Scripting (XSS) vulnerability
    High · 8.7 CVE-2025-24438 <= 2.0.2 no fix
  11. Adobe Commerce Path Traversal
    High · 7.5 CVE-2025-24406 <= 2.0.2 no fix
  12. Adobe Commerce Improper Authorization vulnerability
    High · 8.2 CVE-2025-24409 <= 2.0.2 no fix
  13. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    High · 8.7 CVE-2025-24417 <= 2.0.2 no fix
  14. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    High · 8.7 CVE-2025-24416 <= 2.0.2 no fix
  15. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    High · 8.7 CVE-2025-24415 <= 2.0.2 no fix
  16. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    High · 8.7 CVE-2025-24414 <= 2.0.2 no fix
  17. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    High · 8.7 CVE-2025-24413 <= 2.0.2 no fix
  18. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    High · 8.7 CVE-2025-24412 <= 2.0.2 no fix
  19. Magento Improper Access Control vulnerability
    High · 8.1 CVE-2025-24411 <= 2.0.2 no fix
  20. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    High · 8.7 CVE-2025-24410 <= 2.0.2 no fix
  21. Magento Stored Cross-Site Scripting (XSS) vulnerability
    High · 7.6 CVE-2024-39403 <= 2.0.2 no fix
  22. Magento DOM-based Cross-Site Scripting (XSS) vulnerability
    High · 8.1 CVE-2024-39400 <= 2.0.2 no fix
  23. Magento Path Traversal vulnerability
    High · 7.7 CVE-2024-39399 <= 2.0.2 no fix
  24. Magento does not properly restrict excessive authentication attempts
    High · 7.4 CVE-2024-39398 <= 2.0.2 no fix
  25. Magento OS Command ('OS Command Injection') vulnerability
    High · 8.4 CVE-2024-39402 <= 2.0.2 no fix
  26. Magento OS Command ('OS Command Injection') vulnerability
    High · 8.4 CVE-2024-39401 <= 2.0.2 no fix
  27. Magento Open Source allows Improper Input Validation
    High · 9.0 CVE-2024-20758 <= 2.0.2 no fix
  28. Magento Open Source allows OS Command Injection
    High · 9.1 CVE-2024-20720 <= 2.0.2 no fix
  29. Magento Open Source allows Cross-Site Scripting (XSS)
    High · 9.1 CVE-2024-20719 <= 2.0.2 no fix
  30. Magento affected by remote code execution vulnerability in the CMS page scheduled update feature
    Critical · 9.1 CVE-2021-36021 <= 2.0.2 no fix
  31. Magento improper access control vulnerability within Magento's Media Gallery Upload workflow
    Critical · 9.1 CVE-2021-36036 <= 2.0.2 no fix
  32. Magento XML Injection vulnerability in the Widgets Update Layout
    Critical · 9.1 CVE-2021-36023 <= 2.0.2 no fix
  33. Magento Open Source allows Improper Neutralization of Special Elements Used
    High · 9.1 CVE-2023-38208 <= 2.0.2 no fix
  34. Magento Open Source allows Improper Neutralization of Special Elements Used
    High · 9.1 CVE-2023-29297 <= 2.0.2 no fix
  35. Magento Open Source allows XML Injection
    High · 7.5 CVE-2023-22247 <= 2.0.2 no fix
  36. Magento Open Source allows Stored Cross-Site Scripting (Stored XSS)
    High · 10.0 CVE-2022-35698 <= 2.0.2 no fix
  37. Magento XML Injection vulnerability in the 'City' field
    High CVE-2021-36020 <= 2.0.2 no fix
  38. Magento XML Injection vulnerability in the Widgets Update Layout
    High · 7.2 CVE-2021-36022 <= 2.0.2 no fix
  39. Magento is affected by an improper input validation vulnerability
    High · 8.8 CVE-2021-36032 <= 2.0.2 no fix
  40. Magento has an XML Injection vulnerability
    Critical CVE-2021-36028 <= 2.0.2 no fix
  41. Magento is affected by an improper input validation vulnerability while saving a customer's details
    Critical · 9.1 CVE-2021-36025 <= 2.0.2 no fix
  42. Magento is affected by an os command injection via the Data collection endpoint
    High · 7.2 CVE-2021-36024 <= 2.0.2 no fix
  43. Magento XML Injection vulnerability in the Widgets Module
    Critical CVE-2021-36033 <= 2.0.2 no fix
  44. Magento allows attackers to alter the price of items
    High CVE-2021-36030 <= 2.0.2 no fix
  45. Magento improper authorization vulnerability
    High · 7.2 CVE-2021-36029 <= 2.0.2 no fix
  46. Magento Path Traversal vulnerability via the `theme[preview_image]` parameter
    High CVE-2021-36031 <= 2.0.2 no fix
  47. Magento affected by a blind SSRF vulnerability in the bundled dotmailer extension
    High · 8.0 CVE-2021-36043 <= 2.0.2 no fix
  48. Magento executes code via the API File Option Upload Extension
    Critical · 9.1 CVE-2021-36042 <= 2.0.2 no fix
  49. Magento vulnerable to file upload attack
    High · 7.2 CVE-2021-36041 <= 2.0.2 no fix
  50. Magento affected by remote code execution via a file upload
    High · 7.2 CVE-2021-36034 <= 2.0.2 no fix
  51. Magento has a file extension restrictions bypass
    Critical · 9.1 CVE-2021-36040 <= 2.0.2 no fix
  52. Magento affected by a server-side denial-of-service using a GraphQL field
    High · 7.5 CVE-2021-36044 <= 2.0.2 no fix
  53. Magento Violation of Secure Design Principles vulnerability in RMA PDF filename formats
    High · 7.5 CVE-2021-28583 <= 2.0.2 no fix
  54. Magento stored cross-site scripting (XSS) in the customer address upload feature
    High · 8.1 CVE-2021-21030 <= 2.0.2 no fix
  55. Magento vulnerable to a file upload restriction bypass
    Critical · 9.1 CVE-2021-21014 <= 2.0.2 no fix
  56. Magento XPath Injection
    Critical · 9.1 CVE-2021-21025 <= 2.0.2 no fix
  57. Magento OS command injection via the WebAPI
    Critical · 9.1 CVE-2021-21016 <= 2.0.2 no fix
  58. Magento 2 Community Edition RCE via Unsafe File Upload this entry
    Critical · 9.1 CVE-2020-24407 <= 2.0.2 no fix
  59. Magento DOM-based Cross-site scripting vulnerability
    Critical · 9.6 CVE-2020-9691 <= 2.0.2 no fix
  60. Magento business logic error vulnerability
    Critical · 9.8 CVE-2020-9630 <= 2.0.2 no fix
Show more (12) Showing 60 of 72

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.