CVE-2025-49554
Adobe Commerce | Improper Input Validation (CWE-20)
Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by an Improper Input Validation vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability by providing specially crafted input, causing the application to crash or become unresponsive. Exploitation of this issue does not require user interaction.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Adobe Commerce | Improper Input Validation (CWE-20)
Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by an Improper Input Validation vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability by providing specially crafted input, causing the application to crash or become unresponsive. Exploitation of this issue does not require user interaction.
- Record
CVE-2025-49554- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
EUVDEUVD-2025-24450
Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by an Improper Input Validation vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability by providing specially crafted input, causing the application to crash or become unresponsive. Exploitation of this issue does not require user interaction.
- Record
EUVD-2025-24450- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-xgfm-992v-h2hr
Magento vulnerable to denial of service
Magento versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by an Improper Input Validation vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability by providing specially crafted input, causing the application to crash or become unresponsive. Exploitation of this issue does not require user interaction.
- Record
GHSA-xgfm-992v-h2hr- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
NVD
Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by an Improper Input Validation vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability by providing specially crafted input, causing the application to crash or become unresponsive. Exploitation of this issue does not require user interaction.
- Record
CVE-2025-49554- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSV
Adobe Commerce | Improper Input Validation (CWE-20)
Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by an Improper Input Validation vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability by providing specially crafted input, causing the application to crash or become unresponsive. Exploitation of this issue does not require user interaction.
- Record
CVE-2025-49554- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVGHSA-xgfm-992v-h2hr
Magento vulnerable to denial of service
Magento versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by an Improper Input Validation vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability by providing specially crafted input, causing the application to crash or become unresponsive. Exploitation of this issue does not require user interaction.
- Record
GHSA-xgfm-992v-h2hr- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
magento/project-community-editionPackagist |
through 2.0.2 | None known |
magento/community-editionPackagist |
2.4.9-alpha1 up to 2.4.9-alpha2 | 2.4.9-alpha2 |
magento/community-editionPackagist |
2.4.8-beta1 up to 2.4.8-p2 | 2.4.8-p2 |
magento/community-editionPackagist |
2.4.7-beta1 up to 2.4.7-p7 | 2.4.7-p7 |
magento/community-editionPackagist |
2.4.6-p1 up to 2.4.6-p12 | 2.4.6-p12 |
magento/community-editionPackagist |
before 2.4.5-p14 | 2.4.5-p14 |
magento/community-editionPackagist |
2.4.5 to 2.4.5 | None known |
magento/community-editionPackagist |
2.4.6 to 2.4.6 | None known |
magento/community-editionPackagist |
2.4.7 to 2.4.7 | None known |
magento/community-editionPackagist |
2.4.8 to 2.4.8 | None known |
Show 9 moreShow less
| Package | Affected | Fixed |
|---|---|---|
magento/project-community-editionPackagist |
through 2.0.2, plus listed versions 0.1.0-alpha1000.1.0-alpha1010.1.0-alpha1020.1.0-alpha1030.1.0-alpha104 Show 45 moreShow less0.1.0-alpha1050.1.0-alpha1060.1.0-alpha1070.1.0-alpha1080.1.0-alpha890.1.0-alpha900.1.0-alpha910.1.0-alpha920.1.0-alpha930.1.0-alpha940.1.0-alpha950.1.0-alpha960.1.0-alpha970.1.0-alpha980.1.0-alpha990.42.0-beta10.42.0-beta100.42.0-beta110.42.0-beta20.42.0-beta30.42.0-beta40.42.0-beta50.42.0-beta60.42.0-beta70.42.0-beta80.42.0-beta90.74.0-beta10.74.0-beta100.74.0-beta110.74.0-beta120.74.0-beta130.74.0-beta140.74.0-beta150.74.0-beta160.74.0-beta20.74.0-beta30.74.0-beta40.74.0-beta50.74.0-beta60.74.0-beta70.74.0-beta80.74.0-beta91.0.0-beta2.0.02.0.0-rc |
None known |
magento/community-editionPackagist |
2.4.8-beta1 up to 2.4.8-p2, plus listed versions 2.4.82.4.8-beta22.4.8-p1 |
2.4.8-p2 |
magento/community-editionPackagist |
2.4.7-beta1 up to 2.4.7-p7, plus listed versions 2.4.72.4.7-beta22.4.7-beta32.4.7-p12.4.7-p2 Show 4 moreShow less2.4.7-p32.4.7-p42.4.7-p52.4.7-p6 |
2.4.7-p7 |
magento/community-editionPackagist |
2.4.6-p1 up to 2.4.6-p12, plus listed versions 2.4.6-p102.4.6-p112.4.6-p22.4.6-p32.4.6-p4 Show 5 moreShow less2.4.6-p52.4.6-p62.4.6-p72.4.6-p82.4.6-p9 |
2.4.6-p12 |
magento/community-editionPackagist |
before 2.4.5-p14, plus listed versions 0.1.0-alpha1000.1.0-alpha1010.1.0-alpha1020.1.0-alpha1030.1.0-alpha104 Show 45 moreShow less0.1.0-alpha1050.1.0-alpha1060.1.0-alpha1070.1.0-alpha1080.1.0-alpha890.1.0-alpha900.1.0-alpha910.1.0-alpha920.1.0-alpha930.1.0-alpha940.1.0-alpha950.1.0-alpha960.1.0-alpha970.1.0-alpha980.1.0-alpha990.42.0-beta10.42.0-beta100.42.0-beta110.42.0-beta20.42.0-beta30.42.0-beta40.42.0-beta50.42.0-beta60.42.0-beta70.42.0-beta80.42.0-beta90.74.0-beta10.74.0-beta100.74.0-beta110.74.0-beta120.74.0-beta130.74.0-beta140.74.0-beta150.74.0-beta160.74.0-beta20.74.0-beta30.74.0-beta40.74.0-beta50.74.0-beta60.74.0-beta70.74.0-beta80.74.0-beta91.0.0-beta1.0.0-beta21.0.0-beta3 |
2.4.5-p14 |
magento/community-editionPackagist |
Listed versions 2.4.5 |
None known |
magento/community-editionPackagist |
Listed versions 2.4.6 |
None known |
magento/community-editionPackagist |
Listed versions 2.4.7 |
None known |
magento/community-editionPackagist |
Listed versions 2.4.8 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-49554 is a high vulnerability (CVSS 7.5) in Adobe Commerce, published August 12, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.61%, the 49th percentile. Fixed in magento/community-edition 2.4.9-alpha2.
References
Left out here: 117 versions. The JSON record has them.