Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.5
CVE-2020-9689: Magento Path Traversal Vulnerability Allows Code Execution
CVE-2020-9689 · published 6 years ago
Summary
Magento versions 2.3.5-p1 and earlier are vulnerable to a critical issue that could allow an attacker to inject malicious code. This vulnerability affects Magento websites and stores, potentially leading to unauthorized access and data breaches. Update to the latest patched version of Magento to protect against this risk.
What to do
- Update magento community-edition to version 2.3.5-p2.
- Update magento magento to version 2.3.5 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| composer | magento | community-edition |
< 2.3.5-p2 Fix: upgrade to 2.3.5-p2
|
| composer | magento | project-community-edition | <= 2.0.2 |
| – | magento | magento |
< 2.3.5 2.3.5 cpe:2.3:a:magento:magento:*:*:*:*:commerce:*:*:* |
Original advisory text
Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have a path traversal vulnerability. Successful exploitation could lead to arbitrary code execution.
Magento versions 2.3.5-p1 and earlier, and 2.3.5-p1 and earlier have a path traversal vulnerability. Successful exploitation could lead to arbitrary code execution.
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Type
CWE-22Path Traversal
Timeline
Published29 Jul 2020
Updated23 Oct 2026
First seen6 Mar 2026
Track software like this
Free during beta