Loading vulnerability…
Unrestricted Upload of File with Dangerous Type in Adobe Commerce
CVE-2026-48356 is a critical unrestricted file upload vulnerability in Adobe Commerce and related offerings, including Adobe Commerce B2B, Magento Open Source, and the Adobe Commerce Webhooks Plugin. The flaw is classified as CWE-434 and stems from insufficient restriction of dangerous file types during upload handling. Successful exploitation can result in arbitrary code execution in the context of the current user. Available reporting also indicates the issue may be leveraged for privilege escalation and can affect the victim's account or session. The vulnerability has a changed scope and requires user interaction, specifically that a victim visit a maliciously crafted URL or interact with a compromised web page.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can allow arbitrary code execution in the context of the current user. Depending on the privileges and application context involved, this may enable privilege escalation, execution of attacker-controlled script or code within the application workflow, and compromise of the victim's account or session. Reported impacts for the broader affected product set include arbitrary code execution, privilege escalation, and related security feature bypass outcomes.
If you can’t patch tonight, do this now.
No product-specific workaround is described beyond applying the vendor update. Until patching is complete, reduce exposure by enforcing least privilege, restricting uploadable content types, blocking unnecessary file types, limiting exposure to untrusted web content, and using application allowlisting and endpoint detection controls where operationally feasible.
Patch, then assume compromise.
Upgrade affected products to fixed versions released by Adobe. Fixed releases include Adobe Commerce 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul, 2.4.5-2026-jul, and 2.4.4-2026-jul as applicable; Adobe Commerce B2B 1.5.3-2026-jul, 1.5.2-2026-jul, 1.4.2-2026-jul, 1.3.4-2026-jul, and 1.3.3-2026-jul as applicable; Magento Open Source 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, and 2.4.6-2026-jul as applicable; and Adobe Commerce Webhooks Plugin 1.21.0. Adobe recommends updating installations to the newest available fixed version.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.