Magento Open Source 2.4.6-p8

Magento Open Source 2.4.6-p8 was released on Oct 8, 2024. Its end of support is Aug 11, 2026. Its current support status is end of support.

Release date

Oct 8, 2024

End of support

Aug 11, 2026

Status

end of support

Distribution

Magento Open Source

System requirements

Security end of support

• APSB25-88 critical CVE-2025-54236 fixed in 2.4.6-p12
• APSB25-71 critical CVE-2025-49557 fixed in 2.4.6-p12
• APSB25-50 critical CVE-2025-47110 fixed in 2.4.6-p11
• APSB25-26 critical CVE-2025-27189 fixed in 2.4.6-p10
• APSB25-08 critical CVE-2025-24434 fixed in 2.4.6-p9

Recommended: 2.4.6-p15

Applicable security patches

• APSB24-73 critical CVE-2024-45115 fixed in this release
  Improper authentication (CVE-2024-45115) that allows privilege escalation without prior authentication. Part of the October 2024 patch set that followed the CosmicSting exploitation wave.
• APSB24-61 critical CVE-2024-39397 inherited from 2.4.6-p7
  Unrestricted upload of a file with a dangerous type (CVE-2024-39397) allowing arbitrary code execution by an unauthenticated attacker; Adobe notes the exploit requires the Apache web server. Fixed in the August 2024 patch set.
• APSB24-40 critical CVE-2024-34102 inherited from 2.4.6-p6
  XML external entity injection in the REST API (CVE-2024-34102), publicly known as CosmicSting. An unauthenticated attacker can read arbitrary files such as env.php and, chained with the glibc iconv bug CVE-2024-2961, execute code. Mass exploitation followed within weeks; Adobe also released an isolated patch for stores that could not upgrade.
• APSB24-18 critical CVE-2024-20758, CVE-2024-20759 inherited from 2.4.6-p5
  Improper input validation (CVE-2024-20758) enabling arbitrary code execution by an authenticated administrator, plus stored cross-site scripting (CVE-2024-20759). Published with the 2.4.7 general availability release and the April 2024 patch set.

Quality patches

336 Adobe Quality Patches Tool patches apply to Magento Open Source 2.4.6-p8. Browse and search them.

Previous and next releases

JSON API

Get this release as JSON:

curl -s https://magento.watch/api/v1/magento-community/versions/2.4.6-p8

Sources

• Adobe release notes
• magento/magento2 releases on GitHub
• JSON API: /api/v1/magento-community/versions/2.4.6-p8