-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability (CWE-1336) explicitly involves improper neutralization in template engines. Magento's core templating system relies on PHP-based template rendering. Admin users with template editing privileges could inject malicious code into templates processed by these functions.
getProcessedTemplate is a known high-risk function in email template handling, where variables like {{css ...}} or {{inlinecss ...}} might allow PHP code execution if input isn't sanitized.fetchView directly evaluates template files, and if an attacker controls the template content/path (e.g., via CMS block edits), it could lead to arbitrary code execution. These functions align with the CWE's focus on template engine vulnerabilities and the attack vector described (admin-triggered RCE).| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| magento/community-edition | composer | = 2.4.6 | |
| magento/community-edition | composer | = 2.4.5 | |
| magento/community-edition | composer | = 2.4.4 | |
| magento/community-edition | composer | >= 2.4.5-p1, < 2.4.5-p3 | 2.4.5-p3 |
| magento/community-edition | composer | >= 2.4.4-p1, < 2.4.4-p4 | 2.4.4-p4 |
| magento/project-community-edition | composer | <= 2.0.2 |
A Semantic Attack on Google Gemini - Read the Latest Research