CVE-2026-48356

Adobe Commerce | Unrestricted Upload of File with Dangerous Type (CWE-434)

View on CVE.org
Published Jul 14, 2026 CVSS 3.1 · 9.3 Critical EPSS 47.5% KEV · Listed
Description
Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.

Analysis

AI-generated

Technical impact

Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation requires user interaction: the victim must visit a maliciously crafted URL or interact with a compromised web page, after which the dangerous file can be uploaded and executed. The vulnerability’s scope change indicates that the effect may extend beyond the immediate user to other parts of the application.

Affected Systems

The vulnerability affects Adobe Commerce, Adobe Commerce B2B, Adobe Commerce Events, and Magento Open Source from Adobe. No specific affected versions are listed in the CNA data, so all currently supported releases are potentially impacted until a patch is applied.

Risk and Exploitability

The CVSS score of 9.3 highlights a critical severity, while an EPSS score of 47% indicates a higher probability of exploitation. The issue is listed in the CISA KEV catalog, indicating known exploitation activity, and its high severity demands immediate attention. The attack vector is user interaction; an attacker must entice a user to visit a crafted link or compromised page.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest security patch or upgrade to a version where Adobe Commerce has fixed the file upload restriction flaw.
  • Restrict uploads to approved file types on the application level, ensuring that files with dangerous extensions such as .php, .js, or other executables are rejected.
  • Deploy a Web Application Firewall or similar controls to monitor and block suspicious upload attempts, providing an additional layer of defense while a patch is applied.

Generated by OpenCVE AI on November 4, 2026 at 15:10 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
References
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

 ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'active', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Metrics kev

{'dateAdded': '2026-10-27T00:00:00+00:00', 'dueDate': '2026-11-10T00:00:00+00:00'}
Type Values Removed Values Added
First Time appeared Adobe
Adobe adobe Commerce
Adobe adobe Commerce B2b
Adobe adobe Commerce Webhooks Plugin
Adobe magento Open Source
Vendors & Products Adobe
Adobe adobe Commerce
Adobe adobe Commerce B2b
Adobe adobe Commerce Webhooks Plugin
Adobe magento Open Source
Type Values Removed Values Added
Description Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed. Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.
Metrics cvssV3_1

{'score': 9.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L'}

 cvssV3_1

{'score': 9.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N'}
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.
Title Adobe Commerce | Unrestricted Upload of File with Dangerous Type (CWE-434)
Weaknesses CWE-434
References
Metrics cvssV3_1

{'score': 9.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L'}
Earlier changes (1)
Weaknesses
  • CWE-434

    Unrestricted Upload of File with Dangerous Type

Sources

Status
PUBLISHED
Assigner
adobe
Published
Updated
Oct 28, 2026, 3:55 AM
Reserved
May 21, 2026, 3:28 PM

View source JSON

Updated
Jul 15, 2026, 10:27 AM

JSON

Status
Analyzed
Published
Jul 14, 2026, 8:17 PM
Modified
Oct 28, 2026, 1:34 PM

View source JSON

No data.

Updated
Nov 4, 2026, 3:15 PM

JSON