APSB25-50: Security update available for Adobe Commerce

APSB25-50 (published 2025-06-10) fixes 1 CVE in Adobe Commerce and Magento Open Source 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier; fixed in 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14.

Stored cross-site scripting in the admin panel (CVE-2025-47110) that can be chained into arbitrary code execution when an administrator views the injected content. Fixed in the June 2025 patch set, including 2.4.8-p1.

Published

Jun 10, 2025

Severity

critical

CVEs

1

Isolated patch

no

CVEs

Fixed in

Magento Open Source

2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14

Adobe Commerce

2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14

Mage-OS

—

References

• https://helpx.adobe.com/security/products/magento/apsb25-50.html

For integrators

Get this bulletin as JSON:

curl -s https://magento.watch/api/v1/security-bulletins/APSB25-50