HighCVECVE-2026-48356
[CVE-2026-48356] Adobe Commerce and Magento — Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability
CISA KEV·Source published ·1 min read
What happened?
Adobe Commerce and Magento contain an unrestricted upload of file with dangerous type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes).
Key details
- PHP contains a stale internal request-state vulnerability.
- The flaw allows unauthenticated remote code execution.
- Forensic triage is required for affected systems.
- The vulnerability affects an open-source component used by multiple products.
Affected
- PHP open-source component and products using it.
Fixes and mitigations
- Apply mitigations per vendor instructions and CISA BOD 26-04 guidance.
Summarised by SecOraLens from CISA KEV. Always read the original source before acting. How SecOraLens verifies advisories.