Magento Community Edition Improper Input Validation vulnerability
CISA confirms exploitation of this vulnerability in real attacks. Prioritise checking whether your application is affected. CISA KEV · CC0 1.0
Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality and integrity impact to high. Exploitation of this issue does not require user interaction.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Composer package | magento/community-edition | <= 2.4.5-p14, >= 2.4.6-p1, <= 2.4.6-p12, >= 2.4.9-alpha1, <= 2.4.9-alpha2, >= 2.4.7-beta1, <= 2.4.7-p7, >= 2.4.8-beta1, <= 2.4.8-p2, = 2.4.6, = 2.4.5, = 2.4.7, = 2.4.8, = 2.4.9 | no fix |
| Composer package | magento/project-community-edition | <= 2.0.2 | no fix |
| Magento (core) | magento/community-edition | <= 2.4.5-p14, >= 2.4.6-p1, <= 2.4.6-p12, >= 2.4.9-alpha1, <= 2.4.9-alpha2, >= 2.4.7-beta1, <= 2.4.7-p7, >= 2.4.8-beta1, <= 2.4.8-p2, <= 2.0.2, = 2.4.6, = 2.4.5, = 2.4.7, = 2.4.8, = 2.4.9 | no fix |
References
- https://nvd.nist.gov/vuln/detail/CVE-2025-54236
- https://experienceleague.adobe.com/en/docs/experience-cloud-kcs/kbarticles/ka-27397
- https://github.com/magento/magento2
- https://helpx.adobe.com/security/products/magento/apsb25-88.html
- https://nullsecurityx.codes/cve-2025-54236-sessionreaper-unauthenticated-rce-in-magento
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-54236
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N- Weakness (CWE)
CWE-20- Platform
- Composer, Magento
- Package
magento/community-edition, magento/project-community-edition- Disclosed
- 09.09.2025
- Updated
- 11.10.2026 12:17
Sources and licenses
OSV / GitHub Advisory Database - GHSA-wh92-6q6g-px7j - CC BY 4.0
Vulnerability history: magento/community-edition
All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 360
- First → latest
- 11.2019 10.2025
- Without a fix
- 3
- Exploited in attacks
- 3
Severity breakdown
- Critical 47
- High 104
- Medium 192
- Low 17
Disclosures per year
- 2019: 7
- 2020: 0
- 2021: 0
- 2022: 214
- 2023: 32
- 2024: 62
- 2025: 45
- 2026: 0
-
Magento Community Edition Improper Input Validation vulnerability this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.