Adobe Commerce versions 2.4.6-p1 (and earlier), 2.4.5-p3 (and earlier) and 2.4.4-p4 (and earlier) are affected by a XML Injection (aka Blind XPath Injection) vulnerability that could lead in minor arbitrary file system read. Exploitation of this issue does not require user interaction.

Affected Packages

Packagist magento/community-edition

Affected versions: 2.4.6-p1 (fixed in 2.4.6-p2)

Packagist magento/community-edition

Affected versions: 2.4.5-p1 (fixed in 2.4.5-p4)

Packagist magento/community-edition

Affected versions: 2.4.4-p1 (fixed in 2.4.4-p5)

Packagist magento/project-community-edition

Affected versions: 0 (last affected: 2.0.2)

Related CVEs

CVE-2023-38207

Key Information

GHSA ID

GHSA-rpv2-g4pc-wp72

Published

August 9, 2023 9:30 AM

Last Modified

March 4, 2025 6:18 PM

CVSS Score

2.5 /10

Primary Ecosystem

Packagist

Primary Package

magento/community-edition

GitHub Reviewed

✓ Yes

Dataset

Last updated: August 1, 2025 6:44 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.