Adobe Commerce Unrestricted File Upload RCE via Dangerous Upload
CVE-2026-48356 Published on July 14, 2026

Adobe Commerce | Unrestricted Upload of File with Dangerous Type (CWE-434)
Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.

Vendor Advisory NVD

Under Active Exploitation

This vulnerability is under active exploitation.

Known Exploited Vulnerability

This Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability is part of CISA's list of Known Exploited Vulnerabilities. Adobe Commerce and Magento contain an unrestricted upload of file with dangerous type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session.

The following remediation steps are recommended / required by November 10, 2026: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicab

Vulnerability Analysis

CVE-2026-48356 is exploitable with network access, requires user interaction. This vulnerability is considered to have a low attack complexity. This vulnerability is known to be actively exploited by threat actors. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality and integrity, and no impact on availability.

Exploitation:

ACTIVE

Automatable:

NO

Technical Impact:

TOTAL

Attack Vector:

NETWORK

Attack Complexity:

LOW

Privileges Required:

NONE

User Interaction:

REQUIRED

Scope:

CHANGED

Confidentiality Impact:

HIGH

Integrity Impact:

HIGH

Availability Impact:

NONE

Weakness Type

What is an Unrestricted File Upload Vulnerability?

The software allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment.

CVE-2026-48356 has been classified to as an Unrestricted File Upload vulnerability or weakness.

Products Associated with CVE-2026-48356

Want to know whenever a new CVE is published for Adobe products? stack.watch will email you.

Adobe Commerce

  Watch

Adobe Commerce

  Watch

Adobe Commerce B2b

  Watch

Adobe Magento Open Source

  Watch

Affected Versions

• Before and including 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, 2.4.4-p18 is affected.
• Version 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul, 2.4.5-2026-jul, 2.4.4-2026-jul is unaffected.

• Before and including 1.5.3, 1.5.2-p5, 1.4.2-p10, 1.3.4-p17, 1.3.3-p18 is affected.
• Version 1.5.3-2026-jul, 1.5.2-2026-jul, 1.4.2-2026-jul, 1.3.4-2026-jul, 1.3.3-2026-jul is unaffected.

• Before and including 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15 is affected.
• Version 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul is unaffected.

• Before and including 1.20.0 is affected.
• Version 1.21.0 is unaffected.

Exploit Probability