Advisory details:
vulnrichment / CVE-2025-54236
| Advisory ID | vulnrichment/CVE-2025-54236 |
| Aliases | |
| Summary | Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality, and integrity impact to high. Exploitation of this issue does not require user interaction. |
| Status | Published |
| Exploitability | 0.5 |
| Weighted Severity | 0.0 |
| Risk | |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| CWE-20 | Improper Input Validation |
| System | Score | Found at |
|---|---|---|
| cvssv3.1 | 9.1 | |
| ssvc | Act |
| Reference id | Reference type | URL |
|---|---|---|
| https://helpx.adobe.com/security/products/magento/apsb25-88.html |
| Data source | Metasploit |
|---|---|
| Description | This module exploits CVE-2025-54236 (SessionReaper), a critical vulnerability in Magento/Adobe Commerce that allows unauthenticated remote code execution. The vulnerability stems from improper handling of nested deserialization in the payment method context, combined with an unauthenticated file upload endpoint. The exploit chain consists of three steps: 1. Upload a malicious PHP session file containing a Guzzle/FW1 deserialization payload via the unauthenticated /customer/address_file/upload endpoint 2. Trigger deserialization by sending a crafted JSON payload to the REST API endpoint /rest/default/V1/guest-carts/{cart_id}/order that modifies the session savePath to point to the uploaded file 3. Execute the uploaded PHP code to gain remote code execution This vulnerability affects Magento 2.x instances configured to use file-based session storage. Patched versions will return a 400 Bad Request response instead of processing the malicious payload. |
| Note | Reliability: - repeatable-session Stability: - crash-safe SideEffects: - ioc-in-logs - artifacts-on-disk |
| Ransomware campaign use | Unknown |
| Source publication date | Oct. 22, 2025 |
| Platform | Linux,PHP,Unix,Windows |
| Source URL | https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/multi/http/magento_sessionreaper.rb |
| Data source | KEV |
|---|---|
| Date added | Oct. 24, 2025 |
| Description | Adobe Commerce and Magento Open Source contain an improper input validation vulnerability that could allow an attacker to take over customer accounts through the Commerce REST API. |
| Required action | Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. |
| Due date | Nov. 14, 2025 |
| Note | https://experienceleague.adobe.com/en/docs/experience-cloud-kcs/kbarticles/ka-27397 ; https://nvd.nist.gov/vuln/detail/CVE-2025-54236 |
| Ransomware campaign use | Unknown |
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
| Attack Vector (AV) | Attack Complexity (AC) | Privileges Required (PR) | User Interaction (UI) | Scope (S) | Confidentiality Impact (C) | Integrity Impact (I) | Availability Impact (A) |
|---|---|---|---|---|---|---|---|
network adjacent_network local physical |
low high |
none low high |
none required |
unchanged changed |
high low none |
high low none |
high low none |
Vector: SSVCv2/E:A/A:Y/T:T/P:M/B:A/M:M/D:C/2025-10-24T14:08:30Z/
Decision: Act
Source URL: https://github.com/cisagov/vulnrichment/blob/develop/2025/54xxx/CVE-2025-54236.json
Source Advisory: vulnrichment/CVE-2025-54236
[{'Exploitation': 'active'},
{'Automatable': 'yes'},
{'Technical Impact': 'total'},
{'Mission Prevalence': 'minimal'},
{'Public Well-being Impact': 'material'},
{'Mission & Well-being': 'medium'}]