Adobe Commerce: Unrestricted file upload vulnerability (CVE-2026-48356)
CVE-2026-48356 is an unrestricted file upload vulnerability in Adobe Commerce REST and WYSIWYG endpoints, enabling potential remote code execution via the pub/media directory.
CVE search metadata
CVE search record: CVE-2026-48356. Severity: critical. CVSS: 9.3. EPSS: 47.47%. KEV: no. Product: Adobe Commerce (2.4.4, 2.4.5, 2.4.6, 2.4.7, 2.4.8, 2.4.9). Brief: Adobe Commerce: Unrestricted file upload vulnerability (CVE-2026-48356). Brief link: https://feed.craftedsignal.io/briefs/2026-11-magento-wysiwyg-upload/
Triage facts
Revision 1- Applicability
- Adobe Commerce (2.4.4, 2.4.5, 2.4.6, 2.4.7, 2.4.8, 2.4.9)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 4 public sources
- Freshness
- Revision 1Nov 8, 14:45 UTC
- Detection
- 1 rule
- Vulnerabilities
- 1 CVE
- Source quality
- B2Very likely
CVE-2026-48356 is a high-severity (CVSS 9.3) unrestricted file upload vulnerability affecting Adobe Commerce versions 2.4.4 through 2.4.9. The vulnerability exists within the REST and WYSIWYG upload endpoints, allowing unauthenticated attackers to upload files to the 'pub/media' directory. Publicly available exploit PoCs demonstrate the ability to probe for these endpoints and successfully upload files, which may be leveraged for remote code execution.
Impact
Successful exploitation allows for the upload of arbitrary files to the web server, which can be used to achieve remote code execution if the uploaded files (e.g., PHP scripts) are accessible and executable via the web interface.
Recommendation
- Inventory all Adobe Commerce instances and verify the current version.
- Patch or update Adobe Commerce instances immediately to the latest secure version provided by Adobe.
- Monitor web server access logs for unusual requests to '/rest/V1/wysiwyg/image/upload' or other REST API endpoints.
- Restrict access to administrative and API endpoints via firewall or web application firewall (WAF) rules.
Immediate actions
Patch all Adobe Commerce instances to the latest available version.
Threat Hunt
Identify successful POST requests to the WYSIWYG upload endpoint followed by unauthorized file access in pub/media.
Data: webserver access logs, file system audit logs
Mitigations
Implement WAF blocking for POST requests to /rest/V1/wysiwyg/image/upload if immediate patching is not possible.
CVE-2026-48356
Detection coverage 1
Detect CVE-2026-48356 Exploitation Attempt
highDetects potential exploitation attempts of CVE-2026-48356 by monitoring for HTTP POST requests to the WYSIWYG image upload REST endpoint.
Detection queries are available on the platform. Get full rules →