GHSA-5gmh-85x8-5cx7: Magento remote code execution (RCE), Cross-Site Scripting (XSS) and other vulnerabilities
Magento Commerce and Open Source 2.2.5 and 2.1.14 contain multiple security enhancements that help close authenticated Admin user remote code execution (RCE), Cross-Site Scripting (XSS) and other vulnerabilities.
Published May 15, 2024
Affected packages
magento/community-edition
- Ecosystem
- Composer (PHP)
- Affected
- >= 2.1, < 2.1.14
- Fixed in
- 2.1.14
- Check
composer show magento/community-edition
magento/community-edition
- Ecosystem
- Composer (PHP)
- Affected
- >= 2.2, < 2.2.5
- Fixed in
- 2.2.5
- Check
composer show magento/community-edition
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
Magento Commerce and Open Source 2.2.5 and 2.1.14 contain multiple security enhancements that help close authenticated Admin user remote code execution (RCE), Cross-Site Scripting (XSS) and other vulnerabilities.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology
More Composer (PHP) vulnerabilities
All Composer (PHP) entriesCVE-2025-54236
Magento Community Edition Improper Input Validation vulnerability
critical9.1ExploitedNo fixSep 9, 2025CVE-2025-47110
Magneto contains stored XSS vulnerability
critical9.1No fixJun 10, 2025CVE-2025-24434
Improper Authorization vulnerability in Magento and Adobe Commerce
critical9.1No fixFeb 11, 2025CVE-2024-34102
Magento Open Source affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability
critical9.8ExploitedNo fixJun 13, 2024CVE-2024-34103
Magento Open Source Improper Authentication vulnerability
critical8.1No fixJun 13, 2024GHSA-26hq-7286-mg8f
Magento Patch SUPEE-9652 - Remote Code Execution using mail vulnerability
criticalMay 15, 2024