Description
A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3. An authenticated user with privileges to create products can craft custom layout update and use import product functionality to enable remote code execution.
Remediation
References
Related Vulnerabilities
WebLogic Uncontrolled Resource Consumption Vulnerability (CVE-2025-21549)
PHP Numeric Errors Vulnerability (CVE-2016-4344)
Oracle Database Server CVE-2015-2586 Vulnerability (CVE-2015-2586)
ATutor Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2016-2539)
MySQL Observable Response Discrepancy Vulnerability (CVE-2026-34319)