Adobe Commerce Path Traversal (CVE-2026-34653) Allows File System Read/Write

The National Vulnerability Database has disclosed CVE-2026-34653, a critical path traversal vulnerability impacting multiple versions of Adobe Commerce. This flaw, rated 8.7 CVSS, allows an authenticated attacker with administrative privileges to read and write arbitrary files outside of the restricted directory. No user interaction is required for exploitation.

This isn’t a simple config bypass. An attacker gaining administrative access to an Adobe Commerce instance can leverage this to achieve persistent access, inject web shells, or exfiltrate sensitive data directly from the underlying file system. The scope change to ‘C’ (Changed) indicates a significant impact beyond the immediate component.

While the prerequisite of administrative access might seem high, the reality is that admin credentials for e-commerce platforms are prime targets. Phishing, credential stuffing, or supply chain compromises could easily provide an attacker with the necessary initial foothold, turning this path traversal into a devastating post-exploitation capability.