CVE-2026-48356 is a critical-severity vulnerability, listed in the CISA KEV catalog. AttackerView checks Magento sites for it with a live exploit check.
Detects Adobe Commerce and Magento Open Source stores where anyone can upload a file of any type, with no account and no token. The guest cart REST API accepts a cart item whose custom option carries an embedded file, and the store never checked three things: that the option number belongs to the product, that the option is a file option at all, and what the file is called. The only gate is a look at the first few bytes to see whether they form an image, so a tiny GIF header with a .php name sails through and is written into the media directory under the name the sender chose. Sansec named it PolyShell and recorded a mass attack wave that used it to drop webshells and then inject a card skimmer loader into the store's CMS blocks. The check proves the write rather than assuming it. It asks the storefront GraphQL endpoint for one product code, opens a guest cart, sends the same cart item twice, and compares the answers: once with no file at all, which must come back as the plain option value, and once with a one by one GIF named with a nonce generated for this scan. The store answers the second one with the absolute path it wrote the file to, the decoded byte length and the first twenty hex characters of the file's SHA-256, which the check recomputes locally. Only a server that decoded and stored those exact bytes can produce that hash, so a host that merely echoes requests cannot trigger it. The uploaded payload holds no PHP tags at all, so the artifact it leaves behind cannot run code even on a web server configured to execute it, and the check never tries to fetch it back. CVSS 9.3, CISA Known Exploited Vulnerabilities. Upgrade to the APSB26-73 release for your version line.
Is your app exploitable through CVE-2026-48356?
Scan your domain free