{"id":"CVE-2026-48356","kind":"vulnerability","aliases":["CVE-2026-48356"],"related":[],"title":"Adobe Commerce: unrestricted file upload lets attackers run code","description":"Adobe Commerce and Magento contain an unrestricted upload of file with dangerous type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session.\n\nCISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","summary":"Adobe Commerce and Magento accept uploaded files of dangerous types without restriction. An attacker who uploads such a file can run arbitrary code as the current user and may gain elevated access or control over a victim's account or session.","severity":"critical","cvss":9.3,"epss":null,"exploited":true,"exploited_at":"2026-10-27T00:00:00+00:00","products":[{"name":"Adobe Commerce and Magento","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"adobe commerce","fixed":[],"affected":"= 2.4.4","ecosystem":"vendor"},{"name":"adobe commerce","fixed":[],"affected":"= 2.4.5","ecosystem":"vendor"},{"name":"adobe commerce","fixed":[],"affected":"= 2.4.6","ecosystem":"vendor"},{"name":"adobe commerce","fixed":[],"affected":"= 2.4.7","ecosystem":"vendor"},{"name":"adobe commerce","fixed":[],"affected":"= 2.4.8","ecosystem":"vendor"},{"name":"adobe commerce","fixed":[],"affected":"= 2.4.9","ecosystem":"vendor"},{"name":"adobe commerce b2b","fixed":[],"affected":"= 1.3.3","ecosystem":"vendor"},{"name":"adobe commerce b2b","fixed":[],"affected":"= 1.3.4","ecosystem":"vendor"},{"name":"adobe commerce b2b","fixed":[],"affected":"= 1.4.2","ecosystem":"vendor"},{"name":"adobe commerce b2b","fixed":[],"affected":"= 1.5.2","ecosystem":"vendor"},{"name":"adobe commerce b2b","fixed":[],"affected":"= 1.5.3","ecosystem":"vendor"},{"name":"adobe magento","fixed":[],"affected":"= 2.4.6","ecosystem":"vendor"},{"name":"adobe magento","fixed":[],"affected":"= 2.4.7","ecosystem":"vendor"},{"name":"adobe magento","fixed":[],"affected":"= 2.4.8","ecosystem":"vendor"},{"name":"adobe magento","fixed":[],"affected":"= 2.4.9","ecosystem":"vendor"},{"name":"adobe i\\/o events","fixed":["1.21.0"],"affected":">= 1.6.0, < 1.21.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["adobe-commerce","ecommerce","exploited","magento","php","poc-public","self-hosted","vendor"],"not_affected_if":["unknown"],"how_to_check":"- Check the installed Adobe Commerce or Magento version against the affected list (2.4.4 through 2.4.9, B2B 1.3.3 through 1.5.3) with `bin/magento --version`\n- unknown for other checks: the sources do not say which upload paths or files to inspect","fix":"- Apply the Adobe security update for your Adobe Commerce or Commerce B2B release; fixed version numbers: unknown\n- Apply mitigations per vendor instructions, or discontinue use of the product if mitigations are unavailable (per CISA)","status":"open","published_at":"2026-07-14T20:17:08+00:00","first_seen_at":"2026-10-27T20:02:15+00:00","triaged_at":"2026-10-27T20:04:05+00:00","updated_at":"2026-10-27T21:59:10+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-10-27T20:04:05Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Adobe security update for your Adobe Commerce or Commerce B2B release; fixed version numbers: unknown\n- Apply mitigations per vendor instructions, or discontinue use of the product if mitigations are unavailable (per CISA)","reach":"internet","title":"Adobe Commerce: unrestricted file upload lets attackers run code","impact":"high","summary":"Adobe Commerce and Magento accept uploaded files of dangerous types without restriction. An attacker who uploads such a file can run arbitrary code as the current user and may gain elevated access or control over a victim's account or session.","category":"vendor","nicknames":[],"who_cares":["adobe-commerce","magento","self-hosted","ecommerce","php"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Attacker runs arbitrary code on the store server","analyst_note":"Exploited in the wild per CISA KEV; find the vendor advisory and fixed versions, and the required attacker access, from the NVD and Adobe pages and the linked Sansec report.","how_to_check":"- Check the installed Adobe Commerce or Magento version against the affected list (2.4.4 through 2.4.9, B2B 1.3.3 through 1.5.3) with `bin/magento --version`\n- unknown for other checks: the sources do not say which upload paths or files to inspect","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Sites running Adobe Commerce or Magento in the listed version ranges, including Commerce B2B, are in scope. The sources do not say which configurations or upload features are required, so the exposure of any given store is unknown. CISA directs each owner to evaluate internet exposure of their assets.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.00071,"input_tokens":3906,"output_tokens":638,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-04':172C,198C,229C '-2026':11A,14A '-48356':12A,15A '/o':57A '26':171C,197C,228C 'accept':77B 'access':104B,145C 'accord':161C 'account':111B,152C 'action':157C 'adher':225C 'adob':1A,60B,73B,114C 'adobe':16A,20A,22A,24A,26A,28A,30A,32A,35A,38A,41A,44A,47A,49A,51A,53A,55A 'adobe-commerc':59B 'and':18A 'appli':158C 'applic':195C 'arbitrari':94B,132C 'asset':219C 'attack':7A,86B 'b2b':34A,37A,40A,43A,46A 'base':176C 'bod':170C,196C,227C 'cisa':155C,168C,185C 'cloud':201C 'code':9A,95B,133C 'commerc':2A,61B,74B,115C 'commerce':17A,21A,23A,25A,27A,29A,31A,33A,36A,39A,42A,45A 'complianc':166C 'contain':118C 'context':137C 'control':106B,147C 'could':129C 'current':98B,140C 'cve':10A,13A 'danger':81B,125C 'discontinu':204C 'ecommerc':62B 'elev':103B,144C 'ensur':165C,224C 'evalu':217C 'events':58A 'execut':134C 'exploit':63B 'exposur':222C 'file':4A,79B,91B,123C 'follow':194C 'forens':187C 'gain':102B,143C 'guidanc':183C,199C 'guidelin':231C 'host':71B 'i':56A 'instruct':164C 'internet':221C 'let':6A 'magento':19A,48A,50A,52A,54A,64B,76B,117C 'may':101B 'mitig':159C,210C 'note':182C,193C 'patch':230C 'php':65B 'poc':67B 'poc-publ':66B 'potenti':142C 'priorit':173C 'product':208C 'public':68B 'requir':156C,189C 'respons':215C 'restrict':84B 'result':130C 'risk':178C 'run':8A,93B 'secur':174C 'see':179C,190C 'self':70B 'self-host':69B 'servic':202C 'session':113B,154C 'stakehold':213C 'triag':188C 'type':82B,126C 'unavail':212C 'unrestrict':3A,120C 'updat':175C 'upload':5A,78B,88B,121C 'url':180C,191C 'use':205C 'user':99B,141C 'vendor':72B,163C 'victim':109B,150C 'vulner':127C 'without':83B","nicknames":[],"mitigations":[],"who_affected":"Sites running Adobe Commerce or Magento in the listed version ranges, including Commerce B2B, are in scope. The sources do not say which configurations or upload features are required, so the exposure of any given store is unknown. CISA directs each owner to evaluate internet exposure of their assets.","tier":"A","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-07-14T20:17:08+00:00","kev":{"dateAdded":"2026-10-27","dueDate":"2026-11-10","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","cvss_by":"psirt@adobe.com","poc_count":1,"sources":[{"source":"kev","external_id":"CVE-2026-48356","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-48356","severity":null,"published_at":"2026-10-27T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-27T20:02:15+00:00","fetched_at":"2026-10-27T22:59:14+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-48356","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48356","severity":null,"published_at":"2026-07-14T20:17:08+00:00","modified_at":"2026-08-28T00:17:52+00:00","first_seen_at":"2026-10-27T20:03:15+00:00","fetched_at":"2026-10-27T20:03:15+00:00","note":null},{"source":"github-poc","external_id":"piecar21/CVE-2026-48356","url":"https://github.com/piecar21/CVE-2026-48356","severity":null,"published_at":"2026-10-27T19:52:35+00:00","modified_at":null,"first_seen_at":"2026-10-27T20:06:33+00:00","fetched_at":"2026-10-27T20:06:33+00:00","note":null}],"documents":[{"id":4337,"url":"https://sansec.io/research/magento-cms-block-loader-deepveindrilling","title":"deepveindrilling.com: Magento CMS block loader hits 953 stores | Sansec","kind":"blog","source":"blog","text":"Sansec: loader code injected into Magento cms_block since July 2025 across 953 stores; five domains manulfie.click, neswnsssn.click, lanhd6549tdhse.top, additionalver.com, deepveindrilling.com (registered 2026-10-06, on 83 stores). localStorage key fpCode replays payload. Entry via PolyShell (CVE-2026-48356) and SessionReaper (CVE-2025-54236) uploads. Check: SELECT from cms_block/cms_page WHERE content LIKE '%fpCode%' OR '%se_referrer%' OR '%localStorage.getItem%'; files in pub/media/custom_options/, pub/media/customer_address/, accesson.php; rogue admin_user. Fix: remove, rotate DB/admin/API passwords, install APSB26-73 and APSB25-88.","published_at":"2026-10-24T00:00:00+00:00","relation":"mentions","confidence":null,"note":null},{"id":7668,"url":"https://github.com/piecar21/CVE-2026-48356","title":"piecar21/CVE-2026-48356","kind":"poc","source":"github","text":"PoC / exploit archive for CVE-2026-48356\n\nstars 0","published_at":"2026-10-27T19:52:35+00:00","relation":"poc","confidence":null,"note":"0 stars"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}