Magento Commerce Reflected Cross-site Scripting Vulnerability Could Lead To Arbitrary JavaScript Execution

A flaw in Magento allows an attacker with admin access to inject malicious code into a URL parameter, which runs in a visitor's browser when they click the link. This can steal sensitive information or perform unwanted actions.

Reflected XSS vulnerability in the 'file' parameter affecting Magento 2.4.1, 2.4.0-p1, and 2.3.6 or earlier. Exploitation requires admin-level access to craft the malicious payload; the attack vector is a crafted URL that executes arbitrary JavaScript in the victim's browser context.