CVE-2026-48356: Adobe Commerce Unrestricted File Upload Leading to RCE

Overview

CVE-2026-48356 is a critical unrestricted file upload vulnerability (CWE-434) impacting Adobe Commerce and Magento. Successful exploitation allows for arbitrary code execution in the context of the current user, potentially leading to elevated access or session control. This vulnerability is actively exploited, with observed post-exploitation activity involving CMS block loaders and malicious JavaScript injection.

Technical Analysis

• Vulnerability: CWE-434: Unrestricted Upload of File with Dangerous Type.
• Affected Products: The vulnerability affects multiple versions of Adobe Commerce and Adobe Commerce B2B:
  • Adobe Commerce: 2.4.4, 2.4.5, 2.4.6, 2.4.7, 2.4.8, 2.4.9
  • Adobe Commerce B2B: 1.3.3, 1.3.4, 1.4.2, 1.5.2
• Attack Vector: Remote, network-based. Exploitation requires user interaction, where a victim must visit a maliciously crafted URL or interact with a compromised web page. This interaction facilitates the upload of a dangerous file type.
• Impact: Arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim’s account or session. This can lead to web shell deployment, data exfiltration, and further system compromise.
• CVSS 3.1 Score: 9.3 (CRITICAL) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N.

Detection

• Monitor web server logs (e.g., Apache, Nginx, IIS) for HTTP POST requests to unexpected directories containing file extensions typically associated with server-side scripts (e.g., .php, .phtml, .jsp, .asp).
• Look for web server processes (e.g., php-fpm.exe, httpd.exe, nginx.exe, w3wp.exe) spawning unusual child processes such as cmd.exe, powershell.exe, sh, bash, python.exe, or perl.exe (Sysmon Event ID 1).
• Monitor file system events for new files with dangerous extensions (e.g., .php, .phtml) being written to web-accessible directories by the web server process, especially outside of expected upload paths (Sysmon Event ID 11).
• Scan web server directories for known web shell signatures or suspicious file content.
• Monitor network traffic for outbound connections initiated by the web server process to unusual external IP addresses or domains.
• Review web access logs for requests to newly created or suspicious script files in web root directories, indicative of web shell access (e.g., GET /media/catalog/product/cache/1/image/web_shell.php?cmd=id).

Sigma Detection Rules

Web Server Process Spawning Shell

title: Web Server Process Spawning Shell
id: 5a7b8c9d-e0f1-2345-6789-abcd1234ef01
status: experimental
description: Detects a web server process (e.g., PHP-FPM, Apache, Nginx) spawning a command shell, indicative of arbitrary code execution.
logsource:
  product: windows
  service: sysmon
detection:
  selection_parent:
    ParentImage|endswith:
      - '\php-fpm.exe'
      - '\httpd.exe'
      - '\nginx.exe'
      - '\w3wp.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\sh.exe'
      - '\bash.exe'
      - '\python.exe'
      - '\perl.exe'
  condition: all of selection_*
level: critical

Suspicious File Creation by Web Server Process

title: Suspicious File Creation by Web Server Process
id: 1f2e3d4c-5b6a-7890-1234-56789abcdef0
status: experimental
description: Detects a web server process creating suspicious files with dangerous extensions in web-accessible directories, potentially indicating a web shell upload.
logsource:
  product: windows
  service: sysmon
detection:
  selection_image:
    Image|endswith:
      - '\php-fpm.exe'
      - '\httpd.exe'
      - '\nginx.exe'
      - '\w3wp.exe'
  selection_filename:
    TargetFilename|endswith:
      - '.php'
      - '.phtml'
      - '.jsp'
      - '.asp'
      - '.aspx'
  selection_path:
    TargetFilename|contains:
      - '\inetpub\wwwroot\'
      - '\var\www\html\'
      - '\magento\pub\media\'
      - '\magento\var\'
      - '\upload\'
      - '\cache\'
  condition: all of selection_*
level: high

Web Access to Suspicious Script Files in Web Roots

title: Web Access to Suspicious Script Files in Web Roots
id: 9a8b7c6d-5e4f-3210-fedc-ba9876543210
status: experimental
description: Detects HTTP requests to suspicious script files in web-accessible directories, potentially indicating web shell access or post-exploitation activity.
logsource:
  category: webserver
detection:
  selection_uri:
    cs-uri-stem|contains:
      - '/shell.php'
      - '/cmd.php'
      - '/upload.php'
      - '/backdoor.php'
      - '/eval.php'
      - '/wso.php'
      - '/c99.php'
      - '/r57.php'
      - '/magento/pub/media/'
      - '/magento/var/'
  selection_method:
    cs-method: 'POST'
  condition: selection_uri or (selection_uri and selection_method)
level: high

Mitigations

1. Patch Immediately: Apply the latest security patches from Adobe for all affected Adobe Commerce and Magento installations. Refer to the vendor advisory https://helpx.adobe.com/security/products/magento/apsb26-73.html.
2. Restrict File Uploads: Implement strict validation and sanitization for all user-uploaded files, including type, size, and content. Restrict executable file types from being uploaded to web-accessible directories.
3. Principle of Least Privilege: Ensure the web server process runs with the minimum necessary privileges.
4. Web Application Firewall (WAF): Deploy and configure a WAF to detect and block suspicious file uploads and requests to known web shell patterns.
5. File Integrity Monitoring (FIM): Implement FIM on web server directories to alert on unauthorized creation or modification of files.
6. Regular Audits: Periodically audit web server directories for unauthorized files.

References

• https://helpx.adobe.com/security/products/magento/apsb26-73.html
• https://nvd.nist.gov/vuln/detail/CVE-2026-48356
• https://sansec.io/research/magento-cms-block-loader-deepveindrilling#indicators-of-compromise
• https://sansec.io/research/polyshell-mass-attack-wave
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48356
• https://ltna.com.au/cyber

Indicators of Compromise

MITRE ATT&CK

• T1190 — Exploit Public-Facing Application
• T1505.003 — Web Shell
• T1059 — Command and Scripting Interpreter
• T1059.007 — JavaScript
• T1539 — Steal Web Session Cookie
• T1074.001 — Local Data Staging
• T1566.002 — Spearphishing Link
• T1005 — Data from Local System
• T1140 — Deobfuscate/Decode Files or Information
• T1218 — System Binary Proxy Execution
• T1136.001 — Local Account
• T1056.003 — Web Portal Capture
• T1087.004 — Cloud Account
• T1098 — Account Manipulation
• T1027 — Obfuscated Files or Information
• T1573 — Encrypted Channel
• T1567.002 — Exfiltration to Cloud Storage
• T1070.004 — File Deletion
• T1071.001 — Web Protocols
• T1204.001 — Malicious Link
• T1078.003 — Local Accounts