CVE-2019-7895

CVE-2019-7895 describes a remote code execution vulnerability affecting Magento versions 2.1 prior to 2.1.18, 2.2 prior to 2.2.9, and 2.3 prior to 2.3.2. This flaw allows an authenticated administrator with layout modification privileges to execute arbitrary code by injecting malicious XML into layout updates. Rated 7.2 HIGH, the vulnerability has a low attack complexity and high impact on confidentiality, integrity, and availability, but requires high privileges for exploitation. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.