Magento PolyShell: unrestricted file upload in Magento and Adobe Commerce

A critical flaw in Magento's REST API lets unauthenticated attackers upload executable files to any store. We named the vulnerability "PolyShell" because the attack uses a polyglot (code disguised as image).

Sansec has not observed active exploitation so far. However, the exploit method is circulating already and Sansec expects automated attacks to appear soon.

Affected versions

• Unrestricted file upload — all Magento Open Source and Adobe Commerce versions up to 2.4.9-alpha2
• Stored XSS — all versions pre-2.3.5 or custom webserver config
• RCE via PHP upload — stock nginx 2.0.0–2.2.x (via index.php filename), any version with non-stock nginx passing all .php to fastcgi, Apache pre-2.3.5 without php_flag engine 0
• Patched — 2.4.9-alpha3+ (pre-release only)

The vulnerable code has existed since the very first Magento 2 release. Adobe fixed it in the 2.4.9 pre-release branch as part of APSB25-94, but no isolated patch exists for current production versions. While Adobe provides a sample web server configuration that would largely limit the fallout, the majority of stores use a custom configuration from their hosting provider. Sansec investigated all known Magento and Adobe Commerce stores and found that 55.1% expose files in the upload directory.

Even when execution is blocked, the uploaded file stays on disk. A future configuration change, server migration, or web server swap could expose it.

Recommendations

There is no official patch available for production Magento versions. Until Adobe releases one:

1. Block attacks in real-time. Deploy Sansec Shield to block PolyShell exploitation attempts (use POLYSHELL to run it one month free of charge).
2. Restrict access to the upload directory. Verify that your web server blocks all access to pub/media/custom_options/. For nginx, ensure a location block with deny all exists and is not overridden by a \.php$ regex match. For Apache, verify the .htaccess file is present and effective. NB. blocking access does not block uploads, so people will still be able to upload malicious code if you aren't using a specialized WAF.
3. Scan for compromise. Run eComscan to detect uploaded webshells, backdoors, and other malware.

Technical analysis

Magento's REST API accepts file uploads as part of the cart item custom options. When a product option has type "file", Magento processes an embedded file_info object containing base64-encoded file data, a MIME type, and a filename. The file is written to pub/media/custom_options/quote/ on the server.

GraphQL mutations use a different code path and are not vulnerable.

Timeline

Read more

• SessionReaper attacks have started, 3 in 5 stores still vulnerable
• SessionReaper, unauthenticated RCE in Magento & Adobe Commerce (CVE-2025-54236)
• Claude finds 353 zero-days on Packagist
• ConnectPOS leaked Github secrets for years
• Digital skimmer hits global supermarket chain