Skip to content
OpenAdvisories
Critical · 9.3 Known exploited Public exploit CVE-2026-48356 EUVD-2026-44420GHSA-p3ch-8535-fp8j

Adobe Commerce | Unrestricted Upload of File with Dangerous Type (CWE-434)

Published Jul 14, 2026 · Updated Oct 28, 2026 · Assigned by adobe

Vendor: Adobe Product: Adobe Commerce Product: Adobe Commerce B2B Product: Adobe Commerce Events Product: Magento Open Source Category: Web / CMS

Description

Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.

Affected products

VendorProductAffectedFixed
Adobe Adobe Commerce ≤ 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, 2.4.4-p18 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul, 2.4.5-2026-jul, 2.4.4-2026-jul
Adobe Adobe Commerce B2B ≤ 1.5.3, 1.5.2-p5, 1.4.2-p10, 1.3.4-p17, 1.3.3-p18 1.5.3-2026-jul, 1.5.2-2026-jul, 1.4.2-2026-jul, 1.3.4-2026-jul, 1.3.3-2026-jul
Adobe Magento Open Source ≤ 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul
Adobe Adobe Commerce Events ≤ 1.20.0 1.21.0

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 3 repositories

  • Ghost-Bx1/cve-2026-48356-magento-file-upload-rce ★ 0 · Nov 6, 2026

    CVE-2026-48356 - Adobe Commerce/Magento Unrestricted File Upload RCE | CVSS 9.3 | By Gh0st-Bx1

  • Cyber-BansalAI/polyshell-2026 ★ 0 · Oct 29, 2026

    Indicators and notes for PolyShell (CVE-2026-48356), the Magento and Adobe Commerce file-upload flaw, with credit to the researchers. Not tested, no warranty.

  • abraxas/CVE-2026-48356 ★ 0 · Sep 26, 2026

    CVE-2026-48356 - Magento Open Source - Critical 9.3 - Unauthenticated POST /rest/default/V1/guest-carts/{cartId}/items - Unauthenticated Unrestricted File Upload (PolyShell)

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 1

References