abraxas/cve-2026-75650Disclosure pack and lab reproduction script for CVE-2026-75650, an unauthenticated SSTI RCE in Magento Open Source GraphQL email templates.
abraxaslabs.tech · github.com/abraxas · @abraxas_null · [email protected] · CVE-2026-75650
Magento Open Source 2.4.8-p5 - Adobe
I am @abraxas_null. Loopback lab. The client is CVE-2026-75650-Abraxas-Labs.py.
Unauthenticated email-template SSTI. A GraphQL Store header plants unescaped PHP in var/log/system.log. Guest-cart billing smuggles a signed {{block}}. A declined Payflow payload renders the failed-payment email and includes the log via styles.first. Lab pin 2.4.8-p5. Hotfix VULN-39341 / APSB26-146. CISA KEV. Sansec called it StyleSmuggler.
| CVE | CVE-2026-75650 · CVE.org |
| CWE | CWE-1336 |
| CVSS | Critical: 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
| Product | Magento Open Source |
| Affected | all versions through 2.4.8-p5 (inclusive) |
| Patched | VULN-39341 / APSB26-146 and later |
| Auth | unauthenticated |
| License | GNU Affero GPL v3.0 |
| Lab | 127.0.0.1 only |
Hit GraphQL with no session. Log a PHP witness through the Store header. Smuggle Preview styles that point at that log. Trigger handlePayflowProResponse on a declined payload. The response body includes the witness. That is code execution in the Magento PHP user. The lab oracle is the echo, not a shell.
I mapped the GHSA/Sansec chain onto the tree: email filter signing is str_replace, Preview processes styles, ArrayScanner::collectEntities includes. Then I stood up the loopback Magento stack and ran the client.
Fail-controls already in the lab: an eval/base64/system payload is not the witness; a reverse shell is not the witness; a tree with VULN-39341 applied must not print GHSA75650-WITNESS.
Port 18096. Magento Open Source 2.4.8-p5 without VULN-39341. GraphQL storefront reachable. ./run.sh / setup-magento.sh bring the tree up.
Target only 127.0.0.1:18096 (or the loopback you bound).
python3 CVE-2026-75650-Abraxas-Labs.py
That chdirs into lab/ and runs run.sh (compose up, wait for GraphQL, then poc.py).
Witness: handlePayflowProResponse HTTP body contains GHSA75650-WITNESS from the included system.log.
Ways to lose without learning anything:
Update Magento Open Source / Adobe Commerce to VULN-39341 / APSB26-146 or newer. Re-run CVE-2026-75650-Abraxas-Labs.py against the patched build: GHSA75650-WITNESS must not appear.
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-75650
Abraxas Labs: abraxaslabs.tech · github.com/abraxas · @abraxas_null
GNU Affero GPL v3.0. See LICENSE.
The client talks to loopback. Using it against systems you do not own is not authorized by Abraxas Labs. No warranty.