Sign in
Deutsch English Español Polski
Low

Magento Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability

  • Disclosed: 11.02.2025
  • Updated: 11.10.2026 12:17

Adobe Commerce versions 2.4.7-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability that could result in a security feature bypass. An attacker could exploit this race condition to alter a condition after it has been checked but before it is used, potentially bypassing security mechanisms. Exploitation of this issue requires user interaction.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Composer package magento/community-edition >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12
Composer package magento/project-community-edition <= 2.0.2 no fix
Magento (core) magento/community-edition >= 2.4.7-beta1, < 2.4.7-p4, >= 2.4.6-p1, < 2.4.6-p9, >= 2.4.5-p1, < 2.4.5-p11, < 2.4.4-p12, <= 2.0.2, = 2.4.7, = 2.4.6, = 2.4.5, = 2.4.4, = 2.4.8-beta1 2.4.7-p4, 2.4.6-p9, 2.4.5-p11, 2.4.4-p12

References

CVSS score 3.7/10
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness (CWE)
CWE-367
Platform
Composer, Magento
Package
magento/community-edition, magento/project-community-edition
Disclosed
11.02.2025
Updated
11.10.2026 12:17

Sources and licenses

OSV / GitHub Advisory Database - GHSA-6w27-c66f-gvhq - CC BY 4.0

Vulnerability history: magento/project-community-edition

All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (161) in the archive
Total entries
161
First → latest
11.2019 10.2025
Without a fix
160
Exploited in attacks
1

Severity breakdown

  • Critical 24
  • High 48
  • Medium 77
  • Low 12

Disclosures per year

Severity:
  1. Magento vulnerable to stored Cross-Site Scripting (XSS)
    High · 8.1 CVE-2025-54264 <= 2.0.2 no fix
  2. Magento provides incorrect authorization through a security feature bypass
    High · 8.1 CVE-2025-54263 <= 2.0.2 no fix
  3. Magento Community Edition Improper Input Validation vulnerability
    Critical · 9.1 Exploited in attacks CVE-2025-54236 <= 2.0.2 no fix
  4. Magento Cross-Site Request Forgery (CSRF) vulnerability
    High · 8.1 CVE-2025-49555 <= 2.0.2 no fix
  5. Magento vulnerable to denial of service
    High · 7.5 CVE-2025-49554 <= 2.0.2 no fix
  6. Magento has incorrect authorization issue that leads to arbitrary file system read
    High · 7.5 CVE-2025-49556 <= 2.0.2 no fix
  7. Magento Cross-site Scripting vulnerability
    High · 8.7 CVE-2025-49557 <= 2.0.2 no fix
  8. Magento Improper Authorization leading to security feature bypass
    High · 8.2 CVE-2025-43585 <= 2.0.2 no fix
  9. Improper Authorization vulnerability in Magento and Adobe Commerce
    Critical · 9.1 CVE-2025-24434 <= 2.0.2 no fix
  10. Magento Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability this entry
    Low · 3.7 CVE-2025-24430 <= 2.0.2 no fix
  11. Magento stored Cross-Site Scripting (XSS) vulnerability
    High · 8.7 CVE-2025-24438 <= 2.0.2 no fix
  12. Adobe Commerce Path Traversal
    High · 7.5 CVE-2025-24406 <= 2.0.2 no fix
  13. Adobe Commerce Improper Authorization vulnerability
    High · 8.2 CVE-2025-24409 <= 2.0.2 no fix
  14. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    High · 8.7 CVE-2025-24417 <= 2.0.2 no fix
  15. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    High · 8.7 CVE-2025-24416 <= 2.0.2 no fix
  16. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    High · 8.7 CVE-2025-24415 <= 2.0.2 no fix
  17. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    High · 8.7 CVE-2025-24414 <= 2.0.2 no fix
  18. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    High · 8.7 CVE-2025-24413 <= 2.0.2 no fix
  19. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    High · 8.7 CVE-2025-24412 <= 2.0.2 no fix
  20. Magento Improper Access Control vulnerability
    High · 8.1 CVE-2025-24411 <= 2.0.2 no fix
  21. Magento Stored Cross-Site Scripting (XSS) Vulnerability
    High · 8.7 CVE-2025-24410 <= 2.0.2 no fix
  22. Magento Stored Cross-Site Scripting (XSS) vulnerability
    High · 7.6 CVE-2024-39403 <= 2.0.2 no fix
  23. Magento DOM-based Cross-Site Scripting (XSS) vulnerability
    High · 8.1 CVE-2024-39400 <= 2.0.2 no fix
  24. Magento Path Traversal vulnerability
    High · 7.7 CVE-2024-39399 <= 2.0.2 no fix
  25. Magento does not properly restrict excessive authentication attempts
    High · 7.4 CVE-2024-39398 <= 2.0.2 no fix
  26. Magento OS Command ('OS Command Injection') vulnerability
    High · 8.4 CVE-2024-39402 <= 2.0.2 no fix
  27. Magento OS Command ('OS Command Injection') vulnerability
    High · 8.4 CVE-2024-39401 <= 2.0.2 no fix
  28. Magento Open Source allows Improper Input Validation
    High · 9.0 CVE-2024-20758 <= 2.0.2 no fix
  29. Magento Open Source allows OS Command Injection
    High · 9.1 CVE-2024-20720 <= 2.0.2 no fix
  30. Magento Open Source allows Cross-Site Scripting (XSS)
    High · 9.1 CVE-2024-20719 <= 2.0.2 no fix
  31. Magento affected by remote code execution vulnerability in the CMS page scheduled update feature
    Critical · 9.1 CVE-2021-36021 <= 2.0.2 no fix
  32. Magento improper access control vulnerability within Magento's Media Gallery Upload workflow
    Critical · 9.1 CVE-2021-36036 <= 2.0.2 no fix
  33. Magento XML Injection vulnerability in the Widgets Update Layout
    Critical · 9.1 CVE-2021-36023 <= 2.0.2 no fix
  34. Magento Open Source allows Improper Neutralization of Special Elements Used
    High · 9.1 CVE-2023-38208 <= 2.0.2 no fix
  35. Magento Open Source allows Improper Neutralization of Special Elements Used
    High · 9.1 CVE-2023-29297 <= 2.0.2 no fix
  36. Magento Open Source allows XML Injection
    High · 7.5 CVE-2023-22247 <= 2.0.2 no fix
  37. Magento Open Source allows Stored Cross-Site Scripting (Stored XSS)
    High · 10.0 CVE-2022-35698 <= 2.0.2 no fix
  38. Magento XML Injection vulnerability in the 'City' field
    High CVE-2021-36020 <= 2.0.2 no fix
  39. Magento XML Injection vulnerability in the Widgets Update Layout
    High · 7.2 CVE-2021-36022 <= 2.0.2 no fix
  40. Magento is affected by an improper input validation vulnerability
    High · 8.8 CVE-2021-36032 <= 2.0.2 no fix
Show more (20) Showing 40 of 73

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.