Back Securityaffairs.Co

PolyShell flaw exposes Magento and Adobe Commerce to file upload attacks

Securityaffairs.Co •Pierluigi Paganini • March 21, 2026

Sansec found a Magento and Adobe Commerce REST API flaw, named PolyShell, which allows unauthenticated file uploads and possible XSS in older versions. Sansec disclosed a critical flaw in the Magento and Adobe Commerce REST API that allows attackers to upload executable files without authentication. The issue affects versions up to 2.4.9-alpha2 and could also […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical 'PolyShell' Vulnerability Exposes Magento to RCE and Account Takeover A newly disclosed vulnerability named 'PolyShell' affects all stable versions of Magento Open Source and Adobe Commerce, allowing unauthenticated remote code execution (RCE) and account takeover. The flaw arises from the handling of file uploads in Magento's REST API, specifically when a product option is set to type 'file'. Attackers can upload a polyglot file that functions as both an image and a script, potentially leading to severe security breaches. Although Adobe has released a fix in an alpha version of 2.4.9, production versions remain vulnerable. eCommerce security firm Sansec warns that exploit methods are already circulating, and automated attacks are anticipated soon. Store administrators are advised to restrict access to the upload directory and verify web server configurations until a patch for production versions is available. 10 sources 71

PolyShell flaw exposes Magento and Adobe Commerce to file upload attacks

The full story

Extracted Entities

Platforms (2)

Vulnerabilities (2)