Staging Environment: Content and features may be unstable or change without notice.
Advisory details: github_osv / GHSA-wh92-6q6g-px7j
Advisory ID github_osv/GHSA-wh92-6q6g-px7j
Aliases CVE-2025-54236
Summary Magento Community Edition Improper Input Validation vulnerability Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality and integrity impact to high. Exploitation of this issue does not require user interaction.
Status Published
Exploitability 2.0
Weighted Severity 8.2
Risk 10.0
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (1)
CWE-20 Improper Input Validation
System Score Found at
cvssv3.1 9.1 https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/09/GHSA-wh92-6q6g-px7j/GHSA-wh92-6q6g-px7j.json
generic_textual CRITICAL
Reference id Reference type URL
https://experienceleague.adobe.com/en/docs/experience-cloud-kcs/kbarticles/ka-27397
https://github.com/magento/magento2
https://helpx.adobe.com/security/products/magento/apsb25-88.html
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-54236
CVE-2025-54236 https://nvd.nist.gov/vuln/detail/CVE-2025-54236
CVE-2025-54236-SESSIONREAPER-UNAUTHENTICATED-RCE-IN-MAGENTO https://nullsecurityx.codes/cve-2025-54236-sessionreaper-unauthenticated-rce-in-magento
Data source Metasploit
Description This module exploits CVE-2025-54236 (SessionReaper), a critical vulnerability in Magento/Adobe Commerce that allows unauthenticated remote code execution. The vulnerability stems from improper handling of nested deserialization in the payment method context, combined with an unauthenticated file upload endpoint. The exploit chain consists of three steps: 1. Upload a malicious PHP session file containing a Guzzle/FW1 deserialization payload via the unauthenticated /customer/address_file/upload endpoint 2. Trigger deserialization by sending a crafted JSON payload to the REST API endpoint /rest/default/V1/guest-carts/{cart_id}/order that modifies the session savePath to point to the uploaded file 3. Execute the uploaded PHP code to gain remote code execution This vulnerability affects Magento 2.x instances configured to use file-based session storage. Patched versions will return a 400 Bad Request response instead of processing the malicious payload.
Note 
Reliability:
  - repeatable-session
Stability:
  - crash-safe
SideEffects:
  - ioc-in-logs
  - artifacts-on-disk
Ransomware campaign use Unknown
Source publication date Oct. 22, 2025
Platform Linux,PHP,Unix,Windows
Source URL https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/multi/http/magento_sessionreaper.rb
Data source KEV
Date added Oct. 24, 2025
Description Adobe Commerce and Magento Open Source contain an improper input validation vulnerability that could allow an attacker to take over customer accounts through the Commerce REST API.
Required action Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due date Nov. 14, 2025
Note 
https://experienceleague.adobe.com/en/docs/experience-cloud-kcs/kbarticles/ka-27397 ; https://nvd.nist.gov/vuln/detail/CVE-2025-54236
Ransomware campaign use Unknown

No EPSS data available for this advisory.

Patch URL
There are no known patches.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Found at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/09/GHSA-wh92-6q6g-px7j/GHSA-wh92-6q6g-px7j.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

Vector: SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-10-24T14:08:30Z/

Decision: Act

Source URL: https://github.com/cisagov/vulnrichment/blob/develop/2025/54xxx/CVE-2025-54236.json

Source Advisory: vulnrichment/CVE-2025-54236

View SSVC decision tree 
[{'Exploitation': 'active'},
 {'Automatable': 'yes'},
 {'Technical Impact': 'total'},
 {'Mission Prevalence': 'minimal'},
 {'Public Well-being Impact': 'material'},
 {'Mission & Well-being': 'medium'}]