[APPSEC-2026] Authenticated Remote Code Execution (RCE) through the Magento admin panel (currency configuration)

An administrator user could achieve remote code execution by exploiting a vulnerability in the currency configuration.

Part of update MAGENTO 2.2.5 AND 2.1.14 SECURITY UPDATE

This vulnerability affects the following application versions:

• Magento 2.0.0
• Magento 2.0.0-rc
• Magento 2.0.0-rc2
• Magento 2.0.1
• Magento 2.0.2
• Magento 2.1.13