Loading story…
The PolyShell flaw, tracked in Adobe advisory APSB25-94, allows unauthenticated attackers to use Magento Open Source and Adobe Commerce guest-cart REST API requests to upload attacker-controlled image polyglot files into pub/media/custom_options/. The issue affects production releases reportedly through 2.4.9-alpha2 and stems from validation that accepts image content and MIME types without enforcing that the supplied filename extension matches the validated image format.
Remote code execution is possible when Apache or Nginx exposes the custom-options upload path and permits PHP execution there. Even where server configuration prevents execution, attackers can persist arbitrary files in the directory and may obtain stored XSS if uploaded content is web-accessible. Organizations should apply Adobe’s relevant remediation, ensure upload directories cannot execute scripts or be directly exposed, and investigate pub/media/custom_options/ for unexpected non-image files before making web-server configuration changes.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Sansec published research identifying PolyShell (APSB25-94), an unauthenticated unrestricted file-upload flaw in Magento Open Source and Adobe Commerce. The issue permits persistent placement of attacker-controlled image-valid polyglot files through the guest-cart REST API; remote code execution depends on unsafe web-server configuration.
The issue is indicated as addressed in Magento version 2.4.9-alpha3. No release date for that version is provided.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical Magento vulnerability dubbed **PolyShell** allows unauthenticated attackers to upload arbitrary files through the platform's REST API by disguising malicious payloads as image uploads in cart item custom options. The issue affects all stable versions of **Magento Open Source** and **Adobe Commerce**, and stems from Magento writing base64-encoded file data to a server-accessible upload directory, creating a path to compromise without prior authentication. Depending on web server configuration, successful exploitation can lead to **remote code execution** or **account takeover** through stored cross-site scripting. Adobe addressed the flaw in the `2.4.9` pre-release branch under **APSB25-94**, but no standalone production patch is available, leaving current deployments exposed. Researchers at Sansec said exploit methods are already circulating and warned that automated attacks are likely, urging administrators to restrict access to the affected upload directory, verify web server protections, and scan stores for web shells or other malware.
Jun 29, 2026
Adobe disclosed **CVE-2024-34102**, a critical (CVSS 9.8) pre-authentication XML external entity (XXE) flaw in Adobe Commerce and Magento. The vulnerability lies in recursive REST API deserialization and can be reached through an unauthenticated guest-cart shipping-estimation endpoint, allowing attacker-controlled data to instantiate `SimpleXMLElement` objects and retrieve local or remote resources. An attacker could use the flaw to read Magento's `app/etc/env.php`, exposing the installation's cryptographic key and potentially enabling forged administrator JWTs for privileged Magento API access. Research further indicates the issue could be chained with PHP filter techniques and **CVE-2024-2961** toward remote code execution; organizations should apply Adobe's security update, as early third-party emergency mitigations were bypassable and later revised.
Sep 3, 2026
Attackers are actively exploiting **StyleSmuggler**, an unpatched unauthenticated remote-code-execution chain in Magento Open Source that may also affect Adobe Commerce. The attack injects malicious PHP through Magento template style properties, poisoning a log or report file before triggering its execution through the Payment Transaction Failed Reminder email-rendering path. Sansec reproduced the chain on clean Magento Open Source 2.4.7, 2.4.8, and 2.4.9 systems, while a confirmed victim ran fully patched 2.4.6-p15. Following execution, attackers install a persistent Linux implant using cron and masquerade processes as `kworker`. Reported indicators include download host `247.cdnflare.xyz`, WebSocket-over-TLS C2 endpoint `99.84.67.186:443`, and artifacts under `~/.local/share/.gvfsd/` and `/tmp/.kw_*`. No vendor CVE, patch, or formal workaround was available at the time of reporting; organizations should investigate Magento hosts for compromise, apply layered web controls, consider disabling GraphQL where feasible, and rotate session and application credentials on potentially affected deployments.
Sep 12, 2026