CVE-2026-48356: Magento Open Source, unauthenticated file upload

Guest-cart REST accepts a GIF89a polyglot named with a .php extension. The image check looks at contents and punctuation, then the stored name keeps the caller extension under pub/media/custom_options/quote/.

Name: CVE-2026-48356: Magento Open Source, unauthenticated file upload
Type: N-day analysis
CVE: CVE-2026-48356
CVE Risk: critical
Disclosure Status: public
Vendor: Adobe
Affected: Magento Open Source through 2.4.8-p5. Hotfix APSB26-73 / 2.4.8-2026-jul.
Published: 28 Oct 2026
Updated: 28 Oct 2026
Tags: n-day, magento, upload, cwe-434

Magento Open Source, unauthenticated file upload

Magento Open Source 2.4.8-p5 - Adobe

I am @abraxas_null. Loopback lab. CVE-2026-48356-Abraxas-Labs.py chdirs into lab/ and runs run.sh.

PolyShell. Unauthenticated guest-cart REST accepts file_info that is a GIF89a polyglot with a .php name. ImageContentValidator looks at getimagesizefromstring and punctuation, then ImageProcessor::getFileName keeps the caller extension. The file lands under pub/media/custom_options/quote/. Lab pin 2.4.8-p5. Hotfix APSB26-73 / 2.4.8-2026-jul.

CVE-2026-48356 (NVD). CWE-434. Vendor: Adobe. Magento Open Source through 2.4.8-p5. Hotfix APSB26-73 / 2.4.8-2026-jul.

What an attacker can do

Create a guest cart. POST an item with custom-option file_info named *.php and a GIF header. The add-to-cart JSON echoes the written filename. Anyone who can then hit that media path runs PHP as the Magento user. The lab oracle is the filename in the JSON, not a shell.

How this showed up in the lab

I mapped ImageContentValidator::isValid and the guest-cart option file processor. No option_id / option-type check on that REST path. Then I stood up the loopback stack with a salable simple SKU and ran the client.

Fail-controls already in the lab: eval/base64/system is not the witness; a reverse shell is not the witness; APSB26-73 applied must not print GHSA48356-WITNESS.php.

The lab

Port 18096. Magento Open Source 2.4.8-p5 without APSB26-73. REST guest-carts reachable. seed-product.sh plants lab-sku.

Target only 127.0.0.1:18096 (or the loopback you bound).

Plain text

python3 CVE-2026-48356-Abraxas-Labs.py