Cpe:2.3:a:adobe:i\/O_events:*:*:*:*:*:commerce:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3aadobei%5C/o_eventscommerce/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSun, 08 Nov 2026 14:45:52 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgAdobe Commerce: Unrestricted file upload vulnerability (CVE-2026-48356)https://feed.craftedsignal.io/briefs/2026-11-magento-wysiwyg-upload/Sun, 08 Nov 2026 14:45:52 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-magento-wysiwyg-upload/CVE-2026-48356 is an unrestricted file upload vulnerability in Adobe Commerce REST and WYSIWYG endpoints, enabling potential remote code execution via the pub/media directory.CVE-2026-48356 is a high-severity (CVSS 9.3) unrestricted file upload vulnerability affecting Adobe Commerce versions 2.4.4 through 2.4.9. The vulnerability exists within the REST and WYSIWYG upload endpoints, allowing unauthenticated attackers to upload files to the 'pub/media' directory. Publicly available exploit PoCs demonstrate the ability to probe for these endpoints and successfully upload files, which may be leveraged for remote code execution.

Impact

Successful exploitation allows for the upload of arbitrary files to the web server, which can be used to achieve remote code execution if the uploaded files (e.g., PHP scripts) are accessible and executable via the web interface.

Recommendation

  • Inventory all Adobe Commerce instances and verify the current version.
  • Patch or update Adobe Commerce instances immediately to the latest secure version provided by Adobe.
  • Monitor web server access logs for unusual requests to '/rest/V1/wysiwyg/image/upload' or other REST API endpoints.
  • Restrict access to administrative and API endpoints via firewall or web application firewall (WAF) rules.
]]>highadvisory