TI-2021-09656 Aliases CVE-2021-28584 GHSA-7gpv-xrjr-f5h4

Magento Commerce path traversal vulnerability in child theme store creation

LOW 35CWE-22Published 2021-06-28 · Updated 2024-09-16

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by a Path Traversal vulnerability when creating a store with child theme.Successful exploitation could lead to arbitrary file system write by an authenticated attacker. Access to the admin console is required for successful exploitation.

Why it matters now

EPSS 0.0178 78th percentileScored 2026-11-07

Fix Fixed magento/community-edition (Packagist): 2.4.2-p1, 2.3.7

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Adobe	Magento Commerce	up to 2.4.2; up to 2.3.6-p1; up to 2.4.1-p1; up to None	—	No fix listed	CNA
—	magento/community-edition (Packagist)	2.4.0 to before 2.4.2-p1	2.4.2-p1	Patch available	GHSA-7gpv-xrjr-f5h4
—	magento/community-edition (Packagist)	before 2.3.7	2.3.7	Patch available	GHSA-7gpv-xrjr-f5h4
—	magento/project-community-edition (Packagist)	up to 2.0.2	—	No fix listed	GHSA-7gpv-xrjr-f5h4

Magento Commerce VendorAdobe Affected up to 2.4.2; up to 2.3.6-p1; up to 2.4.1-p1; up to None Fixed in — No fix listed CNA
magento/community-edition (Packagist) Vendor— Affected 2.4.0 to before 2.4.2-p1 Fixed in 2.4.2-p1 Patch available GHSA-7gpv-xrjr-f5h4
magento/community-edition (Packagist) Vendor— Affected before 2.3.7 Fixed in 2.3.7 Patch available GHSA-7gpv-xrjr-f5h4
magento/project-community-edition (Packagist) Vendor— Affected up to 2.0.2 Fixed in — No fix listed GHSA-7gpv-xrjr-f5h4

CPE configurations NVD · 12

CPE	Versions	Role	Vendor
cpe:2.3:a:magento:magento:::::commerce:::*	before 2.3.6	Vulnerable	Magento
cpe:2.3:a:magento:magento:::::open_source:::*	before 2.3.6	Vulnerable	Magento
cpe:2.3:a:magento:magento:2.3.6:-:::commerce:::*	2.3.6	Vulnerable	Magento
cpe:2.3:a:magento:magento:2.3.6:-:::open_source:::*	2.3.6	Vulnerable	Magento
cpe:2.3:a:magento:magento:2.3.6:p1:::commerce:::*	2.3.6 p1	Vulnerable	Magento
cpe:2.3:a:magento:magento:2.3.6:p1:::open_source:::*	2.3.6 p1	Vulnerable	Magento
cpe:2.3:a:magento:magento:2.4.1:-:::commerce:::*	2.4.1	Vulnerable	Magento
cpe:2.3:a:magento:magento:2.4.1:-:::open_source:::*	2.4.1	Vulnerable	Magento
cpe:2.3:a:magento:magento:2.4.1:p1:::commerce:::*	2.4.1 p1	Vulnerable	Magento
cpe:2.3:a:magento:magento:2.4.1:p1:::open_source:::*	2.4.1 p1	Vulnerable	Magento

cpe:2.3:a:magento:magento:*:*:*:*:commerce:*:*:* Versions before 2.3.6 Vulnerable ·Magento
cpe:2.3:a:magento:magento:*:*:*:*:open_source:*:*:* Versions before 2.3.6 Vulnerable ·Magento
cpe:2.3:a:magento:magento:2.3.6:-:*:*:commerce:*:*:* Versions 2.3.6 Vulnerable ·Magento
cpe:2.3:a:magento:magento:2.3.6:-:*:*:open_source:*:*:* Versions 2.3.6 Vulnerable ·Magento
cpe:2.3:a:magento:magento:2.3.6:p1:*:*:commerce:*:*:* Versions 2.3.6 p1 Vulnerable ·Magento
cpe:2.3:a:magento:magento:2.3.6:p1:*:*:open_source:*:*:* Versions 2.3.6 p1 Vulnerable ·Magento
cpe:2.3:a:magento:magento:2.4.1:-:*:*:commerce:*:*:* Versions 2.4.1 Vulnerable ·Magento
cpe:2.3:a:magento:magento:2.4.1:-:*:*:open_source:*:*:* Versions 2.4.1 Vulnerable ·Magento
cpe:2.3:a:magento:magento:2.4.1:p1:*:*:commerce:*:*:* Versions 2.4.1 p1 Vulnerable ·Magento
cpe:2.3:a:magento:magento:2.4.1:p1:*:*:open_source:*:*:* Versions 2.4.1 p1 Vulnerable ·Magento

Show 2 more CPE

CPE	Versions	Role	Vendor
cpe:2.3:a:magento:magento:2.4.2::::commerce:::	2.4.2	Vulnerable	Magento
cpe:2.3:a:magento:magento:2.4.2::::open_source:::	2.4.2	Vulnerable	Magento

cpe:2.3:a:magento:magento:2.4.2:*:*:*:commerce:*:*:* Versions 2.4.2 Vulnerable ·Magento
cpe:2.3:a:magento:magento:2.4.2:*:*:*:open_source:*:*:* Versions 2.4.2 Vulnerable ·Magento

Remediation

Fix · GHSA-7gpv-xrjr-f5h4 magento/community-edition (Packagist) Fixed in 2.4.2-p1 Advisory →
Fix · GHSA-7gpv-xrjr-f5h4 magento/community-edition (Packagist) Fixed in 2.3.7 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2021-28584
2026-10-03 Alias added: GHSA-7gpv-xrjr-f5h4

References

Patch 1

https://helpx.adobe.com/security/products/magento/apsb21-30.html

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2021-28584

Other 2

TI-2026-52938 Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336) KEVCVSS 3.1CRITICAL 10.0
TI-2026-35688 ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) KEVCVSS 3.1CRITICAL 10.0
TI-2025-34084 Adobe Experience Manager | Incorrect Authorization (CWE-863) KEVCVSS 3.1CRITICAL 10.0
TI-2024-22559 XXE can expose crypt key and other secrets granting full admin access KEVCVSS 3.1CRITICAL 9.8
TI-2023-19615 Analysis CVE-2023-29300 Bypass: Adobe ColdFusion Pre-Auth RCE KEVCVSS 3.1CRITICAL 9.8
TI-2023-13696 Adobe ColdFusion Deserialization of Untrusted Data Arbitrary code execution KEVCVSS 3.1CRITICAL 9.8

See all 8046 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences