{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aadobemagento2.4.7open_source/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:adobe:commerce:2.4.4:*:*:*:*:*:*:*","cpe:2.3:a:adobe:commerce:2.4.5:*:*:*:*:*:*:*","cpe:2.3:a:adobe:commerce:2.4.6:*:*:*:*:*:*:*","cpe:2.3:a:adobe:commerce:2.4.7:*:*:*:*:*:*:*","cpe:2.3:a:adobe:commerce:2.4.8:*:*:*:*:*:*:*","cpe:2.3:a:adobe:commerce:2.4.9:-:*:*:*:*:*:*","cpe:2.3:a:adobe:commerce_b2b:1.3.3:*:*:*:*:*:*:*","cpe:2.3:a:adobe:commerce_b2b:1.3.4:*:*:*:*:*:*:*","cpe:2.3:a:adobe:commerce_b2b:1.4.2:*:*:*:*:*:*:*","cpe:2.3:a:adobe:commerce_b2b:1.5.2:*:*:*:*:*:*:*","cpe:2.3:a:adobe:commerce_b2b:1.5.3:-:*:*:*:*:*:*","cpe:2.3:a:adobe:magento:2.4.6:*:*:*:open_source:*:*:*","cpe:2.3:a:adobe:magento:2.4.7:*:*:*:open_source:*:*:*","cpe:2.3:a:adobe:magento:2.4.8:*:*:*:open_source:*:*:*","cpe:2.3:a:adobe:magento:2.4.9:-:*:*:open_source:*:*:*","cpe:2.3:a:adobe:i\\/o_events:*:*:*:*:*:commerce:*:*"],"_cs_cves":[{"cvss":9.3,"id":"CVE-2026-48356"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Adobe Commerce (2.4.4, 2.4.5, 2.4.6, 2.4.7, 2.4.8, 2.4.9)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Adobe"],"content_html":"\u003cp\u003eCVE-2026-48356 is a high-severity (CVSS 9.3) unrestricted file upload vulnerability affecting Adobe Commerce versions 2.4.4 through 2.4.9. The vulnerability exists within the REST and WYSIWYG upload endpoints, allowing unauthenticated attackers to upload files to the 'pub/media' directory. Publicly available exploit PoCs demonstrate the ability to probe for these endpoints and successfully upload files, which may be leveraged for remote code execution.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for the upload of arbitrary files to the web server, which can be used to achieve remote code execution if the uploaded files (e.g., PHP scripts) are accessible and executable via the web interface.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory all Adobe Commerce instances and verify the current version.\u003c/li\u003e\n\u003cli\u003ePatch or update Adobe Commerce instances immediately to the latest secure version provided by Adobe.\u003c/li\u003e\n\u003cli\u003eMonitor web server access logs for unusual requests to '/rest/V1/wysiwyg/image/upload' or other REST API endpoints.\u003c/li\u003e\n\u003cli\u003eRestrict access to administrative and API endpoints via firewall or web application firewall (WAF) rules.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-08T14:45:52Z","date_published":"2026-11-08T14:45:52Z","id":"https://feed.craftedsignal.io/briefs/2026-11-magento-wysiwyg-upload/","summary":"CVE-2026-48356 is an unrestricted file upload vulnerability in Adobe Commerce REST and WYSIWYG endpoints, enabling potential remote code execution via the pub/media directory.","title":"Adobe Commerce: Unrestricted file upload vulnerability (CVE-2026-48356)","url":"https://feed.craftedsignal.io/briefs/2026-11-magento-wysiwyg-upload/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:adobe:magento:2.4.7:*:*:*:open_source:*:*:*","version":"https://jsonfeed.org/version/1.1"}