Magento security update June 2025: CVE-2025-47110 and APSB25-50
In June 2025 Adobe fixed several vulnerabilities in Magento 2 with APSB25-50, including CVE-2025-47110. Affected versions, updates and what the vulnerability requires.
On 10 June 2025, Adobe published security bulletin APSB25-50 for Magento 2 and Adobe Commerce. It fixes several vulnerabilities, including CVE-2025-47110, which is rated critical. Adobe was not aware of any attacks when the bulletin was published.
What is CVE-2025-47110?
An attacker can store script code in certain form fields in the admin panel, which then runs in other users' browsers (stored XSS via template injection). To do so, however, the attacker already needs an admin account with high privileges. The vulnerability is therefore mainly dangerous when an admin login has been compromised or when several people with different levels of trust have access to the admin.
Affected versions and updates
- 2.4.8 → 2.4.8-p1
- 2.4.7-p5 and earlier → 2.4.7-p6
- 2.4.6-p10 and earlier → 2.4.6-p11
- 2.4.5-p12 and earlier → 2.4.5-p13
- 2.4.4-p13 and earlier → 2.4.4-p14
Adobe also released an isolated patch for CVE-2025-47110 that can be applied without a full update.
What I recommend
- Apply the matching update within the next few days, after testing on staging
- Clean up admin accounts: only as many as needed, with individual logins instead of shared passwords
- Keep two-factor authentication for the admin enabled and do not link the admin path publicly
If you need help with the update, write to me.
Source: Adobe APSB25-50. As of June 2025.