Privilege escalation via undisclosed dangerous file upload

Dangerous file upload in Adobe Commerce and Magento Open Source allows remote attackers to escalate privileges through victim interaction. Adobe has not disclosed the upload endpoint, accepted file type, or validation failure that permits dangerous content in Commerce, B2B, and Webhooks components. Exploitation requires no authentication or administrator privileges, but a victim must visit a crafted URL or interact with a compromised page; successful exploitation runs code in the current user's context and can expose or alter that user's account or session.