An administrator with limited privileges could force Magento store notifications to include internal system files.
Part of patch SUPEE-10266
This vulnerability affects the following application versions:
- Magento 1.9.1.1
- Magento 1.9.2.0
- Magento 1.9.2.1
- Magento 1.9.2.2
- Magento 1.9.2.3
- Magento 1.9.2.4
- Magento 1.9.3.0
- Magento 1.9.3.1
- Magento 1.9.3.2
- Magento 1.9.3.3
- Magento 1.9.3.4