[APPSEC-1964] – Remote Code Execution by (semi-)arbitrary file deletion for admin users with access to Import

An administrator with Import permissions could import an XML file that could potentially provide an opportunity for Remote Code Execution (RCE).

Part of patch SUPEE-10570

This vulnerability affects the following application versions:

• Magento 1.9.1.1
• Magento 1.9.2.0
• Magento 1.9.2.1
• Magento 1.9.2.2
• Magento 1.9.2.3
• Magento 1.9.2.4
• Magento 1.9.3.0
• Magento 1.9.3.1
• Magento 1.9.3.2
• Magento 1.9.3.3
• Magento 1.9.3.4
• Magento 1.9.3.6
• Magento 1.9.3.7