2018-06-27: Magento 2.2.5 and 2.1.14 Security update

unknown Affects magento/product-community-edition. Feed 2026.10.29.1, updated 2026-10-28.

Magento 2.2.5 and 2.1.14 Security update

Package: magento/product-community-edition Composer
Affected versions: >=2.1 and <2.1.14 or >=2.2 and <2.2.5
Fixed in: 2.1.14, 2.2.5
Severity: unknown
Exploitation: not on CISA KEV
Source: friendsofphp

References

https://magento.com/security/patches/magento-2.2.5-and-2.1.14-security-update

NVD record magento/product-community-edition advisories

Am I affected?

Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# one-time install
pip install phpwarden

# then
phpwarden deps composer.lock

Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command

Install docs How findings are ranked

Related advisories

CVE-2024-34102 KEV critical Magento Open Source affected by an Improper Restriction of XML External Entity Reference ( same package: magento/product-community-edition
CVE-2019-7139 critical Magento 2 Community Edition SQLi Vulnerability same package: magento/product-community-edition
CVE-2019-7850 unknown PRODSECBUG-2116: Stored cross-site scripting in the catalog events feature same package: magento/product-community-edition
CVE-2019-8159 high Magento 2 Community Edition RCE Vulnerability same package: magento/product-community-edition
CVE-2019-7846 unknown PRODSECBUG-1513: Insufficient brute force protections on promo code entry same package: magento/product-community-edition
CVE-2019-8144 critical Magento 2 Community Edition RCE Vulnerability same package: magento/product-community-edition