CVE Details

CVE-2026-48356 Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability
Published: 2026-10-27 CVSS: 9.3 CRITICAL Product: Adobe Commerce and Magento Due Date: 2026-11-10

Adobe Commerce and Magento contain an unrestricted upload of file with dangerous type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session.

GitHub PoC

Warning: GitHub PoC repositories are unverified. Some may be fake or contain malware. Use caution and review code before running anything.
  • piecar21/CVE-2026-48356 • ⭐ 0 • 2026-10-27 • Conf: 95.0%
  • PoC / exploit archive for CVE-2026-48356
  • abraxas/CVE-2026-48356 • ⭐ 0 • 2026-09-26 • Conf: 95.0%
  • CVE-2026-48356 - Magento Open Source - Critical 9.3 - Unauthenticated POST /rest/default/V1/guest-carts/{cartId}/items - Unauthenticated Unrestricted File Upload (PolyShell)

FIRST EPSS

EPSS estimates the probability of exploitation in the next 30 days. Higher values indicate higher likelihood of real-world exploitation.

Timeline

CVE Stalker KEV MITRE GitHub FIRST (EPSS)

MITRE

CVSS

  • Score: 9.3
  • Severity: CRITICAL
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

SSVC

  • Exploitation: active
  • Automatable: no
  • Technical Impact: total

References

Show Raw Data
Key Remaining Key Value
dataType CVE_RECORD
dataVersion 5.2
cveMetadata > cveId CVE-2026-48356
cveMetadata > assignerOrgId 078d4453-3bcd-4900-85e6-15281da43538
cveMetadata > state PUBLISHED
cveMetadata > assignerShortName adobe
cveMetadata > dateReserved 2026-05-21T15:28:38.140Z
cveMetadata > datePublished 2026-07-14T19:44:17.036Z
cveMetadata > dateUpdated 2026-10-27T19:59:03.206Z
containers > cna > affected > 0 > defaultStatus unaffected
containers > cna > affected > 0 > product Adobe Commerce
containers > cna > affected > 0 > vendor Adobe
containers > cna > affected > 0 > versions > 0 > lessThanOrEqual 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, 2.4.4-p18
containers > cna > affected > 0 > versions > 0 > status affected
containers > cna > affected > 0 > versions > 0 > version 0
containers > cna > affected > 0 > versions > 0 > versionType custom
containers > cna > affected > 0 > versions > 1 > status unaffected
containers > cna > affected > 0 > versions > 1 > version 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul, 2.4.5-2026-jul, 2.4.4-2026-jul
containers > cna > affected > 0 > versions > 1 > versionType custom
containers > cna > affected > 1 > defaultStatus unaffected
containers > cna > affected > 1 > product Adobe Commerce B2B
containers > cna > affected > 1 > vendor Adobe
containers > cna > affected > 1 > versions > 0 > lessThanOrEqual 1.5.3, 1.5.2-p5, 1.4.2-p10, 1.3.4-p17, 1.3.3-p18
containers > cna > affected > 1 > versions > 0 > status affected
containers > cna > affected > 1 > versions > 0 > version 0
containers > cna > affected > 1 > versions > 0 > versionType custom
containers > cna > affected > 1 > versions > 1 > status unaffected
containers > cna > affected > 1 > versions > 1 > version 1.5.3-2026-jul, 1.5.2-2026-jul, 1.4.2-2026-jul, 1.3.4-2026-jul, 1.3.3-2026-jul
containers > cna > affected > 1 > versions > 1 > versionType custom
containers > cna > affected > 2 > defaultStatus unaffected
containers > cna > affected > 2 > product Magento Open Source
containers > cna > affected > 2 > vendor Adobe
containers > cna > affected > 2 > versions > 0 > lessThanOrEqual 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15
containers > cna > affected > 2 > versions > 0 > status affected
containers > cna > affected > 2 > versions > 0 > version 0
containers > cna > affected > 2 > versions > 0 > versionType custom
containers > cna > affected > 2 > versions > 1 > status unaffected
containers > cna > affected > 2 > versions > 1 > version 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul
containers > cna > affected > 2 > versions > 1 > versionType custom
containers > cna > affected > 3 > defaultStatus unaffected
containers > cna > affected > 3 > product Adobe Commerce Events
containers > cna > affected > 3 > vendor Adobe
containers > cna > affected > 3 > versions > 0 > lessThanOrEqual 1.20.0
containers > cna > affected > 3 > versions > 0 > status affected
containers > cna > affected > 3 > versions > 0 > version 0
containers > cna > affected > 3 > versions > 0 > versionType semver
containers > cna > affected > 3 > versions > 1 > status unaffected
containers > cna > affected > 3 > versions > 1 > version 1.21.0
containers > cna > affected > 3 > versions > 1 > versionType semver
containers > cna > datePublic 2026-07-14T17:00:00.000Z
containers > cna > descriptions > 0 > lang en
containers > cna > descriptions > 0 > value Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.
containers > cna > metrics > 0 > cvssV3_1 > attackComplexity LOW
containers > cna > metrics > 0 > cvssV3_1 > attackVector NETWORK
containers > cna > metrics > 0 > cvssV3_1 > availabilityImpact NONE
containers > cna > metrics > 0 > cvssV3_1 > availabilityRequirement NOT_DEFINED
containers > cna > metrics > 0 > cvssV3_1 > baseScore 9.3
containers > cna > metrics > 0 > cvssV3_1 > baseSeverity CRITICAL
containers > cna > metrics > 0 > cvssV3_1 > confidentialityImpact HIGH
containers > cna > metrics > 0 > cvssV3_1 > confidentialityRequirement NOT_DEFINED
containers > cna > metrics > 0 > cvssV3_1 > environmentalScore 9.3
containers > cna > metrics > 0 > cvssV3_1 > environmentalSeverity CRITICAL
containers > cna > metrics > 0 > cvssV3_1 > exploitCodeMaturity NOT_DEFINED
containers > cna > metrics > 0 > cvssV3_1 > integrityImpact HIGH
containers > cna > metrics > 0 > cvssV3_1 > integrityRequirement NOT_DEFINED
containers > cna > metrics > 0 > cvssV3_1 > modifiedAttackComplexity LOW
containers > cna > metrics > 0 > cvssV3_1 > modifiedAttackVector NETWORK
containers > cna > metrics > 0 > cvssV3_1 > modifiedAvailabilityImpact NONE
containers > cna > metrics > 0 > cvssV3_1 > modifiedConfidentialityImpact HIGH
containers > cna > metrics > 0 > cvssV3_1 > modifiedIntegrityImpact HIGH
containers > cna > metrics > 0 > cvssV3_1 > modifiedPrivilegesRequired NONE
containers > cna > metrics > 0 > cvssV3_1 > modifiedScope CHANGED
containers > cna > metrics > 0 > cvssV3_1 > modifiedUserInteraction REQUIRED
containers > cna > metrics > 0 > cvssV3_1 > privilegesRequired NONE
containers > cna > metrics > 0 > cvssV3_1 > remediationLevel NOT_DEFINED
containers > cna > metrics > 0 > cvssV3_1 > reportConfidence NOT_DEFINED
containers > cna > metrics > 0 > cvssV3_1 > scope CHANGED
containers > cna > metrics > 0 > cvssV3_1 > temporalScore 9.3
containers > cna > metrics > 0 > cvssV3_1 > temporalSeverity CRITICAL
containers > cna > metrics > 0 > cvssV3_1 > userInteraction REQUIRED
containers > cna > metrics > 0 > cvssV3_1 > vectorString CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
containers > cna > metrics > 0 > cvssV3_1 > version 3.1
containers > cna > metrics > 0 > format CVSS
containers > cna > metrics > 0 > scenarios > 0 > lang en
containers > cna > metrics > 0 > scenarios > 0 > value GENERAL
containers > cna > problemTypes > 0 > descriptions > 0 > cweId CWE-434
containers > cna > problemTypes > 0 > descriptions > 0 > description Unrestricted Upload of File with Dangerous Type (CWE-434)
containers > cna > problemTypes > 0 > descriptions > 0 > lang en
containers > cna > problemTypes > 0 > descriptions > 0 > type CWE
containers > cna > providerMetadata > orgId 078d4453-3bcd-4900-85e6-15281da43538
containers > cna > providerMetadata > shortName adobe
containers > cna > providerMetadata > dateUpdated 2026-08-27T22:39:18.114Z
containers > cna > references > 0 > tags > 0 vendor-advisory
containers > cna > references > 0 > url https://helpx.adobe.com/security/products/magento/apsb26-73.html
containers > cna > source > discovery EXTERNAL
containers > cna > title Adobe Commerce | Unrestricted Upload of File with Dangerous Type (CWE-434)
containers > cna > x_generator > engine cvelib 1.8.0
containers > adp > 0 > metrics > 0 > other > type ssvc
containers > adp > 0 > metrics > 0 > other > content > id CVE-2026-48356
containers > adp > 0 > metrics > 0 > other > content > role CISA Coordinator
containers > adp > 0 > metrics > 0 > other > content > options > 0 > Exploitation active
containers > adp > 0 > metrics > 0 > other > content > options > 1 > Automatable no
containers > adp > 0 > metrics > 0 > other > content > options > 2 > Technical Impact total
containers > adp > 0 > metrics > 0 > other > content > version 2.0.3
containers > adp > 0 > metrics > 0 > other > content > timestamp 2026-10-27T19:53:15.501701Z
containers > adp > 0 > references > 0 > url https://sansec.io/research/magento-cms-block-loader-deepveindrilling#indicators-of-compromise
containers > adp > 0 > references > 0 > tags > 0 third-party-advisory
containers > adp > 0 > references > 1 > url https://sansec.io/research/polyshell-mass-attack-wave
containers > adp > 0 > references > 1 > tags > 0 third-party-advisory
containers > adp > 0 > references > 2 > url https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48356
containers > adp > 0 > references > 2 > tags > 0 government-resource
containers > adp > 0 > title CISA ADP Vulnrichment
containers > adp > 0 > providerMetadata > orgId 134c704f-9b21-4f2e-91b3-4a467353bcc0
containers > adp > 0 > providerMetadata > shortName CISA-ADP
containers > adp > 0 > providerMetadata > dateUpdated 2026-10-27T19:59:03.206Z