CriticalExploited in the wildCISA KEVPublic exploitVulnerability

CVE-2025-54236

SessionReaper

Published Sep 9, 2025 · Updated 3 days ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 daysNo mention activity in the last 30 days.

CVSS9.1Critical · v3.1

EPSS94.7%100th percentile

CISA KEVYesAdded Oct 24, 2025

In the wildActiveExploitation observed

Vendor: Adobe

IdentifiersCVE-2025-54236CWE-20 · Improper Input Validation

SessionReaper is a critical improper input validation vulnerability in the Adobe Commerce and Magento Open Source REST API. Affected Adobe Commerce releases include 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15, and earlier releases in the corresponding branches. The Web API ServiceInputProcessor permits unsafe nested object construction from attacker-controlled input, exposing sensitive session-management classes. Attackers can bypass security controls and manipulate session state to take over customer accounts without victim interaction. On installations using file-based session storage, a demonstrated chain combines session save-path manipulation, unauthenticated file upload, and PHP object deserialization to achieve remote code execution. The vulnerability has a CVSS v3 base score of 9.1 and has been exploited in the wild.

Do you run this?See affected versions in your environment and whether adversaries are exploiting this vulnerability against assets like yours.

Check your exposure

Analyst brief

Impact, mitigation & remediation

What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation compromises session confidentiality and integrity, allowing customer impersonation, access to sensitive account information, and unauthorized changes to account or transaction data. Administrative session compromise is also reported as a potential outcome. Where the remote-code-execution chain is viable, attackers can execute code with the web-server process's privileges, steal application secrets and database credentials, deploy web shells, establish persistence, and compromise the storefront. Remote code execution is conditional and should not be assumed for every affected configuration.

Mitigation

If you can’t patch tonight, do this now.

Until remediation is complete, restrict REST API access to trusted networks and required integrations, deploy WAF rules for known SessionReaper and malicious deserialization patterns, and disable unnecessary integrations. Restrict administrator access through network controls and MFA. Monitor API requests, abnormal session behavior, unexpected administrator or API-token creation, and unauthorized server-side files. Redis-backed session storage prevents the published filesystem-dependent remote-code-execution chain, but is not a complete mitigation for the underlying vulnerability. Adobe Commerce Cloud WAF protections do not replace required patches.

Remediation

Patch, then assume compromise.

Immediately apply Adobe hotfix VULN-32437-2-4-X-patch and any applicable module updates specified in security bulletin APSB25-88, or upgrade to an applicable vendor-confirmed fixed release. The patch restricts constructor deserialization to simple types and permitted Magento API data-object types, preventing the demonstrated object chain. Verify successful deployment across production and staging environments and regression-test API integrations. Investigate previously exposed installations for compromise, invalidate existing sessions, and rotate administrator credentials and API tokens. If compromise is confirmed, remove malicious artifacts, rotate exposed secrets, and restore or rebuild affected systems from trusted sources as necessary.

Public exploits

Exploits

8 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).

View more in app →

magento_sessionreaper.rbThis repository contains a single Metasploit module (magento_sessionreaper.rb) that exploits CVE-2025-54236, a critical unauthenticated remote code execution vulnerability in Magento/Adobe Commerce 2.x. The exploit leverages improper nested deserialization and an unauthenticated file upload endpoint to achieve code execution. The attack chain involves uploading a malicious PHP session file via /customer/address_file/upload, then triggering deserialization and execution via the /rest/default/V1/guest-carts/{cart_id}/order endpoint. The module supports multiple payloads, including PHP Meterpreter and command shells for Unix/Linux and Windows. The code is mature, weaponized, and part of the Metasploit framework, making it easy to use and customize. The only file in the repository is the exploit module itself, written in Ruby, and it is fully operational for targeting unpatched Magento 2.x instances with file-based session storage.Disclosed Oct 22, 2025 · Framework: metasploit · ruby · networkWeaponized cve-2025-54236This repository provides a working exploit for CVE-2025-54236, a critical unauthenticated remote code execution vulnerability in Adobe Commerce (Magento) via unsafe deserialization in the ServiceInputProcessor class. The exploit leverages the Magento REST API, specifically the /rest/V1/guest-carts and /rest/V1/guest-carts/{cart_id}/estimate-shipping-methods endpoints, to inject a malicious serialized PHP object (using either a Laminas or Monolog gadget chain) into the 'region' or 'extension_attributes' fields of the address object. The payload is generated using the included PHP script (generate_payload.php), which creates a serialized Monolog ProcessHandler object that executes arbitrary system commands. The main exploitation logic is implemented in session_reaper.py, which automates payload generation, cart creation, and payload delivery. The exploit.py script provides a simpler proof-of-concept using a hardcoded payload. The YAML file (CVE-2025-54236.ymal) describes a detection template for the vulnerability, suitable for automated scanners. The repository is operational and provides all necessary components for successful exploitation, assuming the target is vulnerable and accessible.Baba01hacker666 · Disclosed Dec 30, 2025 · python · php · networkOperational SessionReaper-CVE-2025-54236This repository is a small, focused exploit PoC for CVE-2025-54236 ('SessionReaper'), targeting Magento 2 / Adobe Commerce. It contains three files: a detailed README, a Python exploit driver (session_reaper.py), and a minimal PHP payload (payload.php). The Python script is the main entry point and operational exploit. It automates the full attack chain: resolving phpggc locally or via Docker, validating/loading a local PHP payload, optionally authenticating or operating as guest, optionally verifying a SKU and creating a guest cart, generating a malicious serialized session object with the Guzzle/FW1 gadget chain, uploading that fake session file through /customer/address_file/upload, triggering one of three deserialization vectors (address, checkmo, or order), and finally directing the operator to check the dropped PHP file at /errors/404.php. The included payload is benign-looking test code (phpinfo), but the mechanism supports arbitrary PHP content. The exploit is clearly intended for remote unauthenticated web exploitation against vulnerable Magento instances using file-based sessions, and it provides real exploitation capability rather than mere detection. The README documents the vulnerability, attack stages, prerequisites, and the three supported vectors, while the Python code implements the automation and dependency handling.alexb616 · Disclosed Mar 19, 2026 · markdown · php · network · unauthenticated web API deserialization · file upload + session deserializationOperational magento-upload-auto-submit-zonehThis repository contains a single Python exploit script, blabla.py, plus a README. The script is a multithreaded mass-exploitation tool targeting a claimed Magento file upload vulnerability identified in the README as CVE-2025-54236. Its purpose is not merely detection: it attempts to upload a text file to each supplied target, verifies whether the file becomes publicly accessible, and then reports successful targets. Operational flow: the script reads hosts from a user-supplied list file, normalizes them to HTTP(S) URLs, and processes them with 10 worker threads. For each host, it generates a random form_key, sends a multipart POST request to /customer/address_file/upload, and places the payload in the custom_attributes[country_id] field as dog.txt with text/plain content. If the server returns JSON containing a file path, the script then probes likely public media locations (/media/customer_address, /pub/media/customer_address, /media plus returned file path) to confirm the uploaded file is reachable. The verification logic is more than a simple status-code check: it first fetches a random nonexistent path to establish baseline error-page content, then compares retrieved content against common error keywords and a similarity threshold to avoid false positives caused by custom 404 pages. If the uploaded content is confirmed, the script records the host as vulnerable and prints the accessible media URL. A notable secondary capability is automatic submission of successful URLs to Zone-H via http://www.zone-h.org/notify/single using form fields defacer, domain1, hackmode, and reason. This indicates the tool is intended for website defacement reporting rather than benign validation alone. Overall, the repository is small and straightforward: one README and one Python 2-style script using requests, threading, Queue, and difflib. The exploit is operational, supports bulk target processing, includes basic validation and error handling, and carries a hardcoded defacement-style payload rather than a customizable shell or code execution stage.Jenderal92 · Disclosed May 13, 2026 · python · markdown · web · networkOperational session_reaper_labThis repository is a real exploit lab and PoC for CVE-2025-54236 ('SessionReaper'), targeting Magento Open Source and Adobe Commerce up to 2.4.7. The main exploit is `SessionReaper-CVE-2025-54236/session_reaper.py`, a standalone Python script that automates an unauthenticated deserialization-to-RCE chain. It generates a serialized PHP gadget with phpggc (`Guzzle/FW1`), stores it in a fake `sess_<id>` file, uploads that file through `/customer/address_file/upload`, abuses nested JSON deserialization in Magento's `ServiceInputProcessor` to override `session.save_path` to the upload directory, and then triggers PHP session loading with a crafted `PHPSESSID`. Successful exploitation causes PHP to deserialize the attacker-controlled session content and write a PHP payload to disk, typically under `pub/errors/`, yielding a reachable webshell. Repository structure is split into three logical parts: (1) the exploit PoC under `SessionReaper-CVE-2025-54236/`, including `session_reaper.py` and a minimal default `payload.php`; (2) reusable payload artifacts under `payloads/`, including a command webshell and a prebuilt serialized session payload; and (3) a full Dockerized vulnerable Magento lab under `lab-magento/`, with Dockerfile, compose stack, nginx/PHP configuration, and an installation script that intentionally enables file-based sessions and guest checkout. The lab is clearly designed to reproduce the vulnerability safely and consistently. Exploit capabilities are substantial: unauthenticated remote exploitation, multiple deserialization trigger methods (`address`, `checkmo`, `order` per the documentation), optional use of a real guest cart/SKU flow, automatic phpggc discovery or Docker fallback, upload of malicious session files, session path redirection, and arbitrary PHP file write leading to command execution. The included payloads demonstrate both benign validation (`phpinfo`) and active post-exploitation (`system($_GET['cmd'])`). This is not a scanner or detector; it is an operational PoC with a basic but functional payload chain.brito101 · Disclosed May 24, 2026 · python · php · web · networkOperational CVE-2025-54236This repository is a small standalone Python exploit PoC for CVE-2025-54236, described as an Adobe Magento 'SessionReaper' issue. The repository contains only three files: an MIT LICENSE, a README with usage and affected-version claims, and the main exploit script ankamagento.py. The script is the sole code artifact and entry point. Operationally, the exploit normalizes a supplied target URL, creates a requests session with a browser-like User-Agent and retry logic, generates a random form_key, and submits a multipart POST request to /customer/address_file/upload. The uploaded content is any local file chosen by the operator, passed as the second command-line argument and sent in the multipart field custom_attributes[country_id]. The script also sets a Cookie header containing the same generated form_key. If the server returns HTTP 200 and JSON containing a file field, the script strips slashes from the returned path and constructs a verification URL under /media/customer_address/<returned_path>. It then performs a GET request to confirm the uploaded file is publicly accessible. Verified URLs are appended to successfuls.txt; unverified but apparently uploaded paths are written to falsepositive.txt. The code disables TLS verification for both upload and verification requests and includes basic timeout and retry handling. The exploit's main capability is unauthorized file upload with subsequent public retrieval verification. It does not include a remote code execution payload, shell, or post-exploitation logic; instead it supports file placement/defacement-style abuse depending on how the target handles uploaded content. Despite the README calling one output file success.txt, the actual code writes to successfuls.txt, which is a minor implementation inconsistency.Dx3iZ · Disclosed Jul 6, 2026 · python · markdown · webOperational day01-sessionreaper-labThis repository is an educational lab simulating the core vulnerability reported in CVE-2025-54236 ("SessionReaper"). The lab consists of a minimal PHP web application running in a Docker container. The main vulnerability is in 'public/api/service.php', which accepts POSTed JSON and unsafely trusts nested fields under 'payload', leading to a command injection sink via the 'cmd' field. The exploit ('exploit.sh') sends a crafted JSON payload to the API endpoint, triggering command execution and reading the flag from '/opt/flag.txt'. The flag is generated fresh on each container start by 'entrypoint.sh'. The repository includes setup files (Dockerfile, entrypoint.sh), the exploit script, the vulnerable PHP API, and a simple HTML index page. The main purpose is to provide a safe environment to practice exploiting nested JSON vulnerabilities and command injection, not to target real-world systems.amalpvatayam67 · Disclosed Sep 10, 2025 · php · bash · networkPoC CVE-2025-54236_PoCRepository contains a minimal PoC for CVE-2025-54236 targeting Magento/Adobe Commerce 2.4.x, demonstrating likely PHP object injection leading to RCE using a Monolog gadget (Monolog\Handler\ProcessHandler). Structure: - README.md: Step-by-step exploitation workflow: generate a serialized payload, upload it to a Magento customer address file upload endpoint, parse the JSON response to obtain a file-view URL, then request that URL to trigger execution. - generate_payload.php: Payload generator that defines a minimal ProcessHandler class in the Monolog\Handler namespace with private fields `command` (attacker-controlled) and `cwd` (fixed to /tmp), instantiates it with a supplied command, serializes the object, and prints the serialized string. Exploit capabilities: - Generates attacker-controlled PHP serialized object payload intended to be deserialized by the target. - Achieves arbitrary command execution (demonstrated with `touch /tmp/...`) when the uploaded payload is later accessed via the returned viewfile URL. Notable targeting details: - Example target endpoints in README: POST upload to `https://mivetshop.com.ar/customer/address_file/upload` with multipart field `custom_attributes[country_id]=@poc_session.txt` and a `form_key` cookie/field; trigger via returned `https://www.mivetshop.com.ar/customer_custom_attributes/address_file/viewfile/file/<base64-ish>/` URL. - The PoC is not a scanner; it is an exploit demonstration with a simple, user-supplied command payload generator.bolich12 · Disclosed Feb 2, 2026 · php · markdown · networkPoC

Exposure surface

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

AdobeAdobe Commerceapplication

AdobeAdobe Commerce B2bapplication

AdobeCommerceapplication

AdobeCommerce B2bapplication

AdobeMagentoapplication

AdobeMagento Open Sourceapplication

AdobeOpen Sourceapplication

AdobeProject-Community-Editionapplication

External references

References

MITRE CVEcve.org · CVE-2025-54236 NVDnvd.nist.gov/vuln/detail/CVE-2025-54236 MITRE CWE · CWE-20Improper Input Validation Vendor Advisoryexperienceleague.adobe.com/en/docs/experience-cloud-kcs/kbarticles/ka-27397 Vendor Advisoryhelpx.adobe.com/security/products/magento/apsb25-88.html US Government Resourcecisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-54236

Activity feed

Recent activity

234 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

View more in app →

crowdsecNews · Sep 14, 2026CVE-2026-75650: Adobe Commerce & Magento Under AttackA previously reported critical Magento vulnerability mentioned as a comparison and through overlap in scanning sources. The article states that 23 IP addresses targeting StyleSmuggler also attempted SessionReaper, but provides no technical details or evidence of successful SessionReaper exploitation.Read more ↗tenable blogNews · Sep 8, 2026CVE-2026-75650: StyleSmuggler Adobe Commerce FAQ | Tenable®An improper-input-validation vulnerability enabling account takeover through a REST API, referred to as SessionReaper.Read more ↗tenable cloud security pluginsNews · Aug 31, 2026SCA: security update for magento/community-edition, magento/pr... | Tenable®A critical unauthenticated, network-reachable improper input-validation flaw in Adobe Commerce/Magento Community Edition that enables session takeover, with high confidentiality and integrity impact and no user interaction required.Read more ↗slcyber blogNews · Jul 18, 2026Magento RCE via Nested Deserialization: CVE-2025-54236A critical Magento / Adobe Commerce deserialization and security-feature-bypass vulnerability. An unauthenticated attacker can manipulate session configuration through reachable API object chains; on file-based session-storage deployments, this can be combined with an unauthenticated upload endpoint and a crafted serialized PHP session to achieve remote code execution.Read more ↗

+38 more in the timeline. Sign up to see them

Do you run this?See affected versions in your environment and whether adversaries are exploiting this vulnerability against assets like yours.

Check your exposure

Mallory platform

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, and which detections to deploy tonight.

Start Free Trial Open in App ↗

Exposure mappingQuery your assets running an affected version, and investigate the blast radius.

Threat actor evidenceEvery observed campaign linking this CVE to a named adversary.

Associated malware13Malware families riding this exploit, with evidence and IOCs.

Detection signatures3YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mappingCross-references every affected SKU, including bundled OEM variants.

Social activity157Community discussion across Reddit, Mastodon, and other social sources.