CVE-2024-20720: Magento Open Source allows OS Command Injection

February 15, 2024 (updated March 4, 2025)

Adobe Commerce versions 2.4.6-p3, 2.4.5-p5, 2.4.4-p6 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’) vulnerability that could lead in arbitrary code execution by an attacker. Exploitation of this issue does not require user interaction.

References

github.com/advisories/GHSA-525f-pvj5-vqmq
github.com/magento/magento2
helpx.adobe.com/security/products/magento/apsb24-03.html
nvd.nist.gov/vuln/detail/CVE-2024-20720

Detect and mitigate CVE-2024-20720 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →