Attack Chain

1. Initial Access: An unauthenticated attacker sends a crafted HTTP POST request to the /media/amasty_order_attributes/upload endpoint on a vulnerable Magento 2 instance.
2. Exploitation (Arbitrary File Upload): The attacker includes a malicious file, such as a PHP webshell (e.g., shell.php or image.php.txt), within the POST request. The vulnerable endpoint processes this request without requiring any form of authentication, session validation, or cart context.
3. Persistence (File Write): The Amasty Order Attributes component processes the request and writes the malicious file directly into the store's publicly accessible media directory. Attackers may also attempt path traversal techniques to write files to other arbitrary locations.
4. Execution (Webshell Access): The attacker subsequently sends a direct HTTP GET request to the URL of the uploaded PHP webshell (e.g., https://[magento-site]/media/amasty_order_attributes/shell.php).
5. Impact (Remote Code Execution): If the web server is configured to execute PHP files within the media directory, the malicious webshell is executed, granting the attacker remote code execution capabilities on the underlying server.
6. Alternative Impacts: Depending on the uploaded file type, attackers could achieve stored cross-site scripting (XSS) by uploading malicious HTML or SVG files, or host malware for distribution.

Impact

Successful exploitation of CVE-2026-53787 can lead to severe consequences for affected Magento 2 stores. The primary impact is remote code execution, allowing attackers full control over the compromised server, potentially leading to data theft, defacement, or further network penetration. The vulnerability also enables malware hosting, serving malicious content directly from the victim's domain, and stored cross-site scripting (XSS) attacks that could compromise customer data or sessions. Given Magento's e-commerce nature, a compromise could expose sensitive customer information, payment card details, and lead to significant financial and reputational damage. The CVSS v3.1 base score of 9.8 reflects the critical nature of this vulnerability.

Recommendation

• Immediately patch Amasty Order Attributes for Magento 2 to version 4.0.0 or later to address CVE-2026-53787.
• Deploy the Detects CVE-2026-53787 Exploitation - Unauthenticated PHP Upload to Amasty Module Sigma rule to detect attempts to upload malicious files via the vulnerable endpoint.
• Deploy the Detects Access to Malicious Files in Amasty Upload Directory Sigma rule to identify post-exploitation attempts to access uploaded webshells or malicious files.
• Review web server configurations to ensure that the media directory and other upload directories do not permit the execution of PHP or other server-side scripting languages.
• Enable comprehensive webserver access logging and ensure logs are ingested into your SIEM for analysis to support the detection rules above.