CVE-2021-28566: Magento

Low severity, CVSS 2.7. EPSS: 1.4% chance of exploitation in the next 30 days.

Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are vulnerable to an Information Disclosure vulnerability when uploading a modified png file to a product image. Successful exploitation could lead to the disclosure of document root path by an unauthenticated attacker. Access to the admin console is required for successful exploitation.

Affected products

• Magento Magento: up to and including 2.4.2

Published 2021-09-08. Last modified 2026-06-17.