Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type
CVE-2026-48356 is a critical-severity unrestricted upload of file with dangerous type vulnerability in Adobe Commerce from Adobe, with a CVSS 3.1 base score of 9.3 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, but only if a user takes part, for example by opening a link or file. Affected Adobe Commerce versions: 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, 2.4.4-p18 and earlier. The record does not name a fixed version, so check the vendor advisory. CISA added it to the Known Exploited Vulnerabilities catalogue on October 27, 2026, which means attacks have been observed in the wild.
Attackers are already exploiting this vulnerability, according to CISA.
What to do
- Update I/o Events to 1.21.0 or a later version.
- CISA's required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Read the advisory on helpx.adobe.com for workarounds and exact fixed builds.
- Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.
- Because the attack needs a user to take part, warn users about unexpected links and files related to this product until it is patched.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Adobe | Adobe Commerce | 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, 2.4.4-p18 and earlier | Not stated |
| Adobe | Adobe Commerce B2B | 1.5.3, 1.5.2-p5, 1.4.2-p10, 1.3.4-p17, 1.3.3-p18 and earlier | Not stated |
| Adobe | Magento Open Source | 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15 and earlier | Not stated |
| Adobe | Adobe Commerce Events | 1.20.0 and earlier | Not stated |
| Adobe | Commerce | 2.4.4; 2.4.5; 2.4.6; 2.4.7; 2.4.8; 2.4.9 | Not stated |
| Adobe | Commerce B2b | 1.3.3; 1.3.4; 1.4.2; 1.5.2; 1.5.3 | Not stated |
| Adobe | Magento | 2.4.6; 2.4.7; 2.4.8; 2.4.9 | Not stated |
| Adobe | I/o Events | 1.6.0 up to, but not including, 1.21.0 | 1.21.0 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- NetworkCan be exploited remotely over a network, including the internet.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- NoneNo account or login is needed.
- User interaction
- RequiredA user must take an action such as opening a file or link.
- Scope
- ChangedThe attack can reach beyond the vulnerable component into other systems.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- NoneAvailability is not affected.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N. Scored by NVD.
| Scoring system | Score | Severity | Scored by |
|---|---|---|---|
| CVSS 3.1 | 9.3 | Critical | CNA (adobe.com) |
| CVSS 3.1 | 9.3 | Critical | NVD |
Official description
Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
How developers prevent this class of flaw
- Generate a new, unique filename for an uploaded file instead of using the user-supplied filename, so that no external input is used at all.
- When the set of acceptable objects, such as filenames or URLs, is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames or URLs, and reject all other inputs.
- Consider storing the uploaded files outside of the web document root entirely. Then, use other mechanisms to deliver the files dynamically.
More Unrestricted Upload of File with Dangerous Type vulnerabilities (CWE-434)
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: active, automatable: no, technical impact: total).
- Added to CISA's Known Exploited Vulnerabilities catalogue.
- Record last changed materially (score, affected products, status or references).
- Deadline for US federal agencies to remediate, set by CISA.
References
Third-party and government advisories
- sansec.io/research/magento-cms-block-loader-deepveindrilling#indicators-of-compromiseThird Party Advisory
- sansec.io/research/polyshell-mass-attack-waveThird Party Advisory
- cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48356US Government Resource
Other vulnerabilities in Adobe Commerce
- 9.1 Critical severity
- 8.1 High severity
- 8.7 High severity
- 7.2 High severity
- 9.8 Critical severity
- 8.3 High severity
Recent Unrestricted Upload of File with Dangerous Type vulnerabilities
- 9.1 Critical severity
- 8.8 High severity
- 10.0 Critical severity
- 9.9 Critical severity
- 8.8 High severity
- 9.8 Critical severity
Spotted an error? Tell us.