PolyShell: Critical Magento Flaw Allows Unauthenticated RCE, Exploited Since March 2026
CVE-2026-48356 is a critical unrestricted file upload vulnerability in Adobe Commerce and Magento Open Source. Unauthenticated attackers can submit polyglot files through guest-cart REST item routes and write them under pub/media/custom_options/. When the web server executes or serves that path as PHP, the result can be remote code execution or stored XSS. Mass exploitation has been observed since March 2026, including links to CMS-block loaders on hundreds of stores. The issue is listed in the CISA KEV catalog. This article covers how the flaw works, campaign activity, indicators of compromise, affected and fixed versions under APSB26-73, and practical remediation steps.
Summary
CVE-2026-48356
is a critical unrestricted file upload issue in Adobe Commerce and Magento Open Source. Unauthenticated callers can submit a polyglot file through guest-cart REST item routes and write it under pub/media/custom_options/. When the web server executes or serves that path as PHP, the result can be remote code execution or stored XSS leading to session takeover.
The research name PolyShell (from Sansec) reflects abuse with polyglot files that pass Magento’s image header checks while still carrying executable PHP. Adobe addressed the issue in bulletin APSB26-73 on 14 July 2026. Mass exploitation was observed from March 2026. CISA added the CVE to the Known Exploited Vulnerabilities catalog on 27 October 2026, with a federal remediation due date of 10 November 2026.
Vulnerability Details
| CVE ID | CVSS Score | EPSS Score | Type |
|---|---|---|---|
| CVE-2026-48356 | 9.6 (Critical) | 59.078% | CWE-434: Unrestricted Upload of File with Dangerous Type |
Adobe rates impact as privilege escalation. Published vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L
(network, low complexity, no privileges, user interaction on the scored path, changed scope, high confidentiality and integrity impact).
Technical Information
CVE-2026-48356 — Unrestricted file upload via guest-cart custom options
Magento’s REST API accepts file uploads as part of cart item custom options. An embedded file_info object carries base64 content, a MIME type, and a filename. The file is written under pub/media/custom_options/quote/.
Validation gaps in the vulnerable path include:
- The submitted option ID is not verified against the product’s real options
- Upload logic still runs when the product has no file-type option
- Dangerous extensions such as
.php,.phtml, and.pharare not blocked. The main content check is an image header test, which a polyglot image-plus-PHP file can pass
The highest-exposure routes need no credentials: POST /V1/guest-carts/:cartId/items and PUT /V1/guest-carts/:cartId/items/:itemId, typically under /rest/ or /rest/<store_code>/. Other REST routes can reach the same logic. GraphQL mutations use a different path and are not affected.
Upload still succeeds when directory access is blocked. Only stopping the API call prevents new files from landing on disk. Impact depends on web server configuration. Many hosts still execute or serve content from the upload tree. Nginx deny rules must sit before any PHP location. Apache needs a working .htaccess that denies access and disables the PHP engine for that path. Files left on disk remain dangerous after a later config change or migration.
Exploitation Timeline and Campaign Activity
Abuse of the guest-cart upload path was observed at scale through early 2026. Fixed builds and the later KEV listing define the main public milestones.
-2026-jul releases).
Public reporting in October 2026 described 953 online stores with scanner-evading JavaScript loaders in Magento CMS blocks. A substantial share of those infections was linked to this vulnerability as the initial write path (about 471 via this upload issue; about 102 via this issue or SessionReaper). Loaders may fingerprint real shoppers versus scanners and may cache payload in browser localStorage. In documented cases, unpatched stores still had polyglot webshells under pub/media/custom_options/quote/ alongside a CMS-block loader, and at least one fully patched store was still compromised through a rogue administrator account used to inject the block.
Adobe’s APSB26-73 text stated it was not aware of in-the-wild use for issues in that bulletin at publication time. Independent observations of mass abuse predated the KEV entry by several months.
Impact
-
Unauthenticated write under the media treeGuest-cart custom-option uploads can place attacker-controlled files under
pub/media/custom_options/with no account required. -
Remote code execution when PHP runsHosts that execute or serve PHP from that path can turn a polyglot upload into code execution on the web server account.
-
Stored XSS and session riskUploaded HTML or script content served to browsers can target customers or administrators and support session takeover.
-
Persistent backdoors and CMS loadersFollow-on activity includes
accesson.phpcopies across the document root and CMS-block loaders that survive file-only cleanup.
Affected Products and Versions
Per APSB26-73:
- Adobe Commerce: 2.4.9, 2.4.8-p5 and earlier, 2.4.7-p10 and earlier, 2.4.6-p15 and earlier, 2.4.5-p17 and earlier, 2.4.4-p18 and earlier
- Adobe Commerce B2B: 1.5.3, 1.5.2-p5 and earlier, 1.4.2-p10 and earlier, 1.3.4-p17 and earlier, 1.3.3-p18 and earlier
- Magento Open Source: 2.4.9, 2.4.8-p5 and earlier, 2.4.7-p10 and earlier, 2.4.6-p15 and earlier
- Adobe Commerce Events: 1.6.0 to 1.20.0
Confirm the running build with bin/magento --version and Composer metadata. Fixed releases use the -2026-jul suffix.
Indicators of Compromise
The following indicators are associated with exploitation of CVE-2026-48356 and related post-exploitation activity. Use filesystem checks, REST access logs, and network controls together.
Source IP addresses observed in scanning
3.12.250[.]833.88.149[.]413.150.234[.]24718.220.50[.]15323.22.254[.]3531.134.0[.]5331.134.1[.]3431.134.7[.]11731.134.11[.]17331.134.15[.]8931.134.15[.]25145.136.24[.]21345.136.26[.]18145.136.27[.]21845.147.233[.]21145.147.234[.]7345.155.166[.]22852.24.6[.]11964.49.38[.]9678.129.161[.]6379.130.2[.]2381.169.144[.]13591.132.124[.]183103.216.223[.]206109.107.178[.]102115.79.194[.]68136.244.92[.]114140.235.2[.]103140.235.171[.]72140.248.75[.]31140.248.75[.]114162.159.113[.]66185.3.235[.]111193.151.188[.]86193.233.216[.]217193.233.221[.]124194.180.233[.]186198.186.130[.]10199.96.165[.]186212.87.218[.]43216.38.6[.]1372001:19f0:6c01:15da:5400:6ff:fe05[:]e560
Upload paths and filenames
Any .php, .phtml, or .phar under pub/media/custom_options/ is a strong indicator. Observed names include:
index.php(often with an option-id prefix, e.g.780index.php)json-shell.phpbypass.phtmlc.php,r.php,rce.php,static.php,test.phpblocked-json.php,bypass-async.php,urlencode-shell.php,xx_malicious_file.phpato_poc.html,mikhail.html,accesson.phptoggige-arrow.jpg,adman.429.txt,adman.309.txt- Unicode-obfuscated names that decode to
bypass.php - Image-header files (for example GIF89a or PNG) that also contain PHP
accesson.php secondary backdoor paths
var/assets/images/accesson.phpbamboo-specs/assets/images/accesson.phplib/assets/images/accesson.phpapp/assets/images/accesson.phpvendor/assets/images/accesson.phppub/assets/images/accesson.phpbin/assets/images/accesson.phpsetup/assets/images/accesson.phpgenerated/assets/images/accesson.phpphpserver/assets/images/accesson.php
Live shells may respond with the fingerprint value 8194460. Cookie-gated execution and an upload parameter were reported in the same family.
Loader domains
Domains observed in Magento CMS-block loader activity over the broader campaign include:
manulfie[.]clickneswnsssn[.]clicklanhd6549tdhse[.]topadditionalver[.]comdeepveindrilling[.]comjslibrary[.]netcanevaslab[.]com
Search CMS pages, static blocks, and the cms_block table for these domains or unexpected script tags. File cleanup alone does not remove database-resident loaders.
Review REST logs for guest-cart item requests carrying file_info, especially from sources that never complete checkout. Also audit for unexpected administrator accounts.
MITRE ATT&CK Mapping
| Technique ID | Technique Name | Tactic ID | Tactic |
|---|---|---|---|
| T1190 | Exploit Public-Facing Application | TA0001 | Initial Access |
| T1505.003 | Server Software Component: Web Shell | TA0003 | Persistence |
| T1105 | Ingress Tool Transfer | TA0011 | Command and Control |
Mitigation and Recommendations
Apply APSB26-73 fixed builds for every Commerce, Magento Open Source, B2B, and Events instance, including staging and agency-hosted copies. Confirm the -2026-jul (or equivalent fixed) build is live on all nodes.
Fixed versions
- Adobe Commerce: 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul, 2.4.5-2026-jul, 2.4.4-2026-jul
- Adobe Commerce B2B: 1.5.3-2026-jul, 1.5.2-2026-jul, 1.4.2-2026-jul, 1.3.4-2026-jul, 1.3.3-2026-jul
- Magento Open Source: 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul
- Adobe Commerce Events: 1.21.0
Recommended actions
- Until every node is patched, block or inspect guest-cart item requests that carry
file_infoat the WAF, especially filenames ending in.php,.phtml,.phar, or.html. Directory deny rules do not stop uploads. - Deny web access and PHP execution under
pub/media/custom_options/. On nginx, place the deny block before any PHP location. On Apache, ensure.htaccessdenies access and disables the PHP engine for that path. - Hunt for webshells and
accesson.php, clean CMS blocks and static content, remove rogue admin accounts, and rotate database, admin, and integration credentials after cleanup. - Restrict admin URL access, require multi-factor authentication, and monitor for new files under media paths and unexpected script tags in
cms_block.
Example nginx deny (before any \.php$ location):
Example Apache content under pub/media/custom_options/.htaccess:
Instantly Fix Risks in Endpoints & Cloud with Saner
Saner is a continuous and integrated vulnerability & exposure management platform that instantly fixes risks in endpoints and cloud.
