Magento Open Source 2.4.4-p13 was released on Apr 8, 2025. Its end of support is Apr 12, 2025. Its current support status is end of support.

Release date: Apr 8, 2025
End of support: Apr 12, 2025
Status: end of support
Distribution: Magento Open Source

System requirements

Runtime

PHP 8.1
Composer 2.2

Database

MySQL 8.0
MariaDB 10.6
AWS Aurora MySQL 5.7

Search

OpenSearch 2.19
Elasticsearch 7.17
AWS OpenSearch 1.2
AWS Elasticsearch 7.9

Cache

Redis 7.2
Varnish 7.6
AWS ElastiCache redis-6

Queue

RabbitMQ 3.9
AWS MQ 3.8.11

Web server & storage

nginx 1.26
Apache 2.4
AWS S3 supported

Security end of support

APSB25-88 critical CVE-2025-54236 fixed in 2.4.4-p15
APSB25-71 critical CVE-2025-49557 fixed in 2.4.4-p15
APSB25-50 critical CVE-2025-47110 fixed in 2.4.4-p14

Recommended: 2.4.4-p18

Applicable security patches

APSB25-26 critical CVE-2025-27189 fixed in this release

Improper authorization (CVE-2025-27189) allowing a security feature bypass, published alongside the 2.4.8 general availability release. Older lines receive the fix through their April 2025 patch versions.
APSB25-08 critical CVE-2025-24434 inherited from 2.4.4-p12

Improper authorization (CVE-2025-24434) that lets a low-privileged actor escalate privileges; Adobe rated it critical because exploitation does not require user interaction. Fixed in the February 2025 patch set.
APSB24-73 critical CVE-2024-45115 inherited from 2.4.4-p11

Improper authentication (CVE-2024-45115) that allows privilege escalation without prior authentication. Part of the October 2024 patch set that followed the CosmicSting exploitation wave.
APSB24-61 critical CVE-2024-39397 inherited from 2.4.4-p10

Unrestricted upload of a file with a dangerous type (CVE-2024-39397) allowing arbitrary code execution by an unauthenticated attacker; Adobe notes the exploit requires the Apache web server. Fixed in the August 2024 patch set.
APSB24-40 critical CVE-2024-34102 inherited from 2.4.4-p9

XML external entity injection in the REST API (CVE-2024-34102), publicly known as CosmicSting. An unauthenticated attacker can read arbitrary files such as env.php and, chained with the glibc iconv bug CVE-2024-2961, execute code. Mass exploitation followed within weeks; Adobe also released an isolated patch for stores that could not upgrade.
APSB24-18 critical CVE-2024-20758, CVE-2024-20759 inherited from 2.4.4-p8

Improper input validation (CVE-2024-20758) enabling arbitrary code execution by an authenticated administrator, plus stored cross-site scripting (CVE-2024-20759). Published with the 2.4.7 general availability release and the April 2024 patch set.

Quality patches

349 Adobe Quality Patches Tool patches apply to Magento Open Source 2.4.4-p13. Browse and search them.

Previous and next releases

Previous 2.4.5-p12 Apr 8, 2025 Next 2.4.4-p14 Jun 5, 2025

JSON API

Get this release as JSON:

curl -s https://magento.watch/api/v1/magento-community/versions/2.4.4-p13