CVE-2026-75650: Magento Open Source, unauthenticated template injection

A GraphQL Store header plants unescaped PHP in the system log. Guest-cart billing smuggles a block directive. A declined Payflow response renders that template and includes the log. The lab oracle is the echo.

Name: CVE-2026-75650: Magento Open Source, unauthenticated template injection
Type: N-day analysis
CVE: CVE-2026-75650
CVE Risk: critical
Disclosure Status: public
Vendor: Adobe
Affected: Magento Open Source through 2.4.8-p5. Hotfix VULN-39341 / APSB26-146.
Published: 28 Oct 2026
Updated: 28 Oct 2026
Tags: n-day, magento, ssti, cwe-1336

Magento Open Source, unauthenticated template injection

Magento Open Source 2.4.8-p5 - Adobe

I am @abraxas_null. Loopback lab. The client is CVE-2026-75650-Abraxas-Labs.py.

Unauthenticated email-template SSTI. A GraphQL Store header plants unescaped PHP in var/log/system.log. Guest-cart billing smuggles a signed {{block}}. A declined Payflow payload renders the failed-payment email and includes the log via styles.first. Lab pin 2.4.8-p5. Hotfix VULN-39341 / APSB26-146. CISA KEV. Sansec called it StyleSmuggler.

CVE-2026-75650 (NVD). CWE-1336. Vendor: Adobe. Magento Open Source through 2.4.8-p5. Hotfix VULN-39341 / APSB26-146.

What an attacker can do

Hit GraphQL with no session. Log a PHP witness through the Store header. Smuggle Preview styles that point at that log. Trigger handlePayflowProResponse on a declined payload. The response body includes the witness. That is code execution in the Magento PHP user. The lab oracle is the echo, not a shell.

How this showed up in the lab

I mapped the GHSA/Sansec chain onto the tree: email filter signing is str_replace, Preview processes styles, ArrayScanner::collectEntities includes. Then I stood up the loopback Magento stack and ran the client.

Fail-controls already in the lab: an eval/base64/system payload is not the witness; a reverse shell is not the witness; a tree with VULN-39341 applied must not print GHSA75650-WITNESS.

The lab

Port 18096. Magento Open Source 2.4.8-p5 without VULN-39341. GraphQL storefront reachable. ./run.sh / setup-magento.sh bring the tree up.

Target only 127.0.0.1:18096 (or the loopback you bound).

Plain text

python3 CVE-2026-75650-Abraxas-Labs.py

That chdirs into lab/ and runs run.sh (compose up, wait for GraphQL, then poc.py).