CVE-2026-77110

No fix known EPSS 1%CVSS 7.6

Adobe Commerce is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in a Security feature bypass. An attacker with high privileges could leverage this vulnerability to access unauthorized files or directories outside the intended restrictions, causing a limited disruption to availability. Exploitation of this issue does not require user interaction. Scope is changed.

Published 2026-09-08 · CVE record · OSV

Products: Adobe Commerce, Adobe Commerce B2B, adobe magento_open_source