Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability
TL;DR 📌
- Adobe Commerce and Magento contain an unrestricted upload of file with dangerous type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim’s account or session.
- Highest CVSS: 9.3 (Critical).
- Listed in CISA KEV (2026-10-27) — this is being exploited in the wild.
- Fixed in
1.21.0— upgrade to this release or later. - CVEs: CVE-2026-48356.
What it is
CVE-2026-48356 is an unrestricted file upload vulnerability in Adobe Commerce and Magento. The flaw allows a file of a dangerous type to be uploaded and subsequently executed, leading to arbitrary code execution in the context of the current user.
The attack requires user interaction: a victim must visit a maliciously crafted URL or interact with a compromised web page. This is not a case of an attacker directly reaching an exposed upload endpoint over the network without any user involvement — the path runs through getting a logged-in user to trigger the request, which the CVSS vector reflects (AV:N/AC:L/PR:N/UI:R). No privileges are required on the attacker’s side, but the victim’s session and permissions are what get leveraged.
The vector also shows a changed scope (S:C), meaning the impact extends beyond the vulnerable component itself, with high confidentiality and integrity impact and no availability impact. In practice this means successful exploitation can give an attacker elevated access or control over the victim’s account or session, potentially extending into other parts of the Commerce/Magento installation that the affected user can reach.
This CVE is listed in CISA’s Known Exploited Vulnerabilities catalogue, added on 2026-10-27.
What to do
- Patch to the fixed release: 1.21.0. The advisory should be consulted for the exact component/module this version number applies to, as the fixed version supplied does not map to a standard Adobe Commerce platform release number.
- Treat this as urgent given its KEV listing — prioritise it over routine patch cycles.
- Because exploitation depends on user interaction (a crafted URL or compromised page), review admin and user training around clicking unsolicited links while logged into Commerce/Magento backends, as a compensating measure until patched.
- Audit upload directories and recently modified files for signs of unexpected file types or unauthorised code, particularly in areas reachable by authenticated users with upload-capable roles.
- Restrict and monitor admin and customer-facing upload functionality where feasible, pending confirmation that the fix is deployed across all affected instances.
For leadership 🧭
Executive summary. An actively exploited flaw in Adobe Commerce and Magento can let an attacker hijack a logged-in user’s session and run code by getting that user to click a crafted link, with no password needed on the attacker’s side. Because it’s on CISA’s exploited list, this needs patching ahead of the normal release cycle, not queued behind routine work.
Why it matters:
- Exploitation relies on tricking a logged-in Commerce or Magento user into visiting a crafted URL or compromised page, so anyone with store-admin or upload-capable accounts is a potential entry point.
- The changed scope in the CVSS vector means a successful attack can reach beyond the upload component into whatever else that user’s session has access to within the Commerce/Magento install.
- The vulnerability is already listed in CISA’s Known Exploited Vulnerabilities catalogue, added 27 October 2026, indicating it is being used against live targets.
- High confidentiality and integrity impact with arbitrary code execution means an attacker gaining a user’s session could read or alter store data and plant malicious code via the upload path.
Now / Next / Later:
- Now: Identify every Adobe Commerce or Magento instance in your environment and check its version against the fixed release 1.21.0, flagging any that are behind.
- Next: Apply the fix in the next available change window, verifying with Adobe which component the 1.21.0 version number applies to since it doesn’t map to a standard platform release, and audit upload directories for unexpected file types in the meantime.
- Later: Put ongoing controls in place to restrict and monitor who can use upload functionality in admin and customer-facing areas, and build staff awareness around not clicking unsolicited links while logged into the Commerce/Magento backend.