---
id: "CVE-2026-48356"
kind: "vulnerability"
aliases: ["CVE-2026-48356"]
title: "Adobe Commerce: unrestricted file upload lets attackers run code"
severity: "critical"
cvss: 9.3
epss: null
exploited: true
status: "open"
category: "vendor"
products: [{"name": "Adobe Commerce and Magento", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "adobe commerce", "fixed": [], "affected": "= 2.4.4", "ecosystem": "vendor"}, {"name": "adobe commerce", "fixed": [], "affected": "= 2.4.5", "ecosystem": "vendor"}, {"name": "adobe commerce", "fixed": [], "affected": "= 2.4.6", "ecosystem": "vendor"}, {"name": "adobe commerce", "fixed": [], "affected": "= 2.4.7", "ecosystem": "vendor"}, {"name": "adobe commerce", "fixed": [], "affected": "= 2.4.8", "ecosystem": "vendor"}, {"name": "adobe commerce", "fixed": [], "affected": "= 2.4.9", "ecosystem": "vendor"}, {"name": "adobe commerce b2b", "fixed": [], "affected": "= 1.3.3", "ecosystem": "vendor"}, {"name": "adobe commerce b2b", "fixed": [], "affected": "= 1.3.4", "ecosystem": "vendor"}, {"name": "adobe commerce b2b", "fixed": [], "affected": "= 1.4.2", "ecosystem": "vendor"}, {"name": "adobe commerce b2b", "fixed": [], "affected": "= 1.5.2", "ecosystem": "vendor"}, {"name": "adobe commerce b2b", "fixed": [], "affected": "= 1.5.3", "ecosystem": "vendor"}, {"name": "adobe magento", "fixed": [], "affected": "= 2.4.6", "ecosystem": "vendor"}, {"name": "adobe magento", "fixed": [], "affected": "= 2.4.7", "ecosystem": "vendor"}, {"name": "adobe magento", "fixed": [], "affected": "= 2.4.8", "ecosystem": "vendor"}, {"name": "adobe magento", "fixed": [], "affected": "= 2.4.9", "ecosystem": "vendor"}, {"name": "adobe i\\/o events", "fixed": ["1.21.0"], "affected": ">= 1.6.0, < 1.21.0", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["adobe-commerce", "ecommerce", "exploited", "magento", "php", "poc-public", "self-hosted", "vendor"]
not_affected_if: ["unknown"]
published_at: "2026-07-14T20:17:08+00:00"
first_seen_at: "2026-10-27T20:02:15+00:00"
updated_at: "2026-10-27T21:59:10+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-48356", "first_seen_at": "2026-10-27T20:02:15+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48356", "first_seen_at": "2026-10-27T20:03:15+00:00"}, {"source": "github-poc", "url": "https://github.com/piecar21/CVE-2026-48356", "first_seen_at": "2026-10-27T20:06:33+00:00"}]
---

# Adobe Commerce: unrestricted file upload lets attackers run code

Adobe Commerce and Magento accept uploaded files of dangerous types without restriction. An attacker who uploads such a file can run arbitrary code as the current user and may gain elevated access or control over a victim's account or session.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Adobe Commerce and Magento affected ? fixed ?
- vendor:adobe commerce affected = 2.4.4 fixed ?
- vendor:adobe commerce affected = 2.4.5 fixed ?
- vendor:adobe commerce affected = 2.4.6 fixed ?
- vendor:adobe commerce affected = 2.4.7 fixed ?
- vendor:adobe commerce affected = 2.4.8 fixed ?
- vendor:adobe commerce affected = 2.4.9 fixed ?
- vendor:adobe commerce b2b affected = 1.3.3 fixed ?
- vendor:adobe commerce b2b affected = 1.3.4 fixed ?
- vendor:adobe commerce b2b affected = 1.4.2 fixed ?
- vendor:adobe commerce b2b affected = 1.5.2 fixed ?
- vendor:adobe commerce b2b affected = 1.5.3 fixed ?
- vendor:adobe magento affected = 2.4.6 fixed ?
- vendor:adobe magento affected = 2.4.7 fixed ?
- vendor:adobe magento affected = 2.4.8 fixed ?
- vendor:adobe magento affected = 2.4.9 fixed ?
- vendor:adobe i\/o events affected >= 1.6.0, < 1.21.0 fixed 1.21.0

## How to check

- Check the installed Adobe Commerce or Magento version against the affected list (2.4.4 through 2.4.9, B2B 1.3.3 through 1.5.3) with `bin/magento --version`
- unknown for other checks: the sources do not say which upload paths or files to inspect

## Fix

- Apply the Adobe security update for your Adobe Commerce or Commerce B2B release; fixed version numbers: unknown
- Apply mitigations per vendor instructions, or discontinue use of the product if mitigations are unavailable (per CISA)

## Timeline

- 2026-10-27T20:02:15+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-48356
- 2026-10-27T20:03:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-48356
- 2026-10-27T20:06:33+00:00 github-poc https://github.com/piecar21/CVE-2026-48356

## Documents

- [mentions] deepveindrilling.com: Magento CMS block loader hits 953 stores | Sansec https://sansec.io/research/magento-cms-block-loader-deepveindrilling
- [poc] piecar21/CVE-2026-48356 https://github.com/piecar21/CVE-2026-48356

## From the sources

Adobe Commerce and Magento contain an unrestricted upload of file with dangerous type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session.

CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_