dinosn/cve-2026-75650-magento-validation-labDocker lab for validating the CVE-2026-75650 Magento component-level PHP execution primitive and Adobe VULN-39341 patch.
This standalone lab reproduces the StyleSmuggler component-level PHP execution primitive on a revision-pinned Magento Open Source 2.4.9 checkout and then proves that Adobe's VULN-39341 patch blocks the identical input.
The proof is non-destructive: included PHP can only write one random marker in
/tmp. It cannot run a command, download a file, open a callback, or accept an
operator-supplied payload.
The lab provides:
755e34dd689021c5165db9d35ecff74f7dc51527;The lab does not claim a stock unauthenticated HTTP exploit. The component probe starts at the real email-template model, so it proves the dangerous sink and the patch boundary, not the missing network-to-template connector. No synthetic HTTP route is added.
Use only on systems you own or are explicitly authorized to test. Do not place the PHP probe under a production web root. For a real installation, use the read-only validator or validate a disposable staging clone.
Requirements:
Only the developer-mode storefront gateway is published, and only on loopback
(127.0.0.1:8096 by default). A second unexposed nginx gateway selects standard
production error handling so the report test receives Magento's normal report
identifier. MariaDB, Redis, OpenSearch, PHP-FPM, and that report gateway are not
exposed to the host network.
cd docker-lab
cp .env.example .env
docker compose up -d --build
docker compose logs -f php
The initial Magento clone, dependency install, and application install normally
take 15–40 minutes. When the PHP log prints Ready, run:
docker compose exec -T php bash /lab/scripts/run-ab.sh
Or use the convenience targets:
make up
make wait
make ab
The A/B command always attempts to leave the source in the patched state.
The test passes only when both independently tested halves behave as expected:
Unpatched report: raw-tag=true, guard=false
Patched report: raw-tag=false, guard=true, neutralized=true
Unpatched component: marker=true
Patched component: marker=false
[PASS] Report storage and component execution match the required A/B controls.
An HTTP 200, rendered notification, generated error report, or thrown exception is not accepted as execution proof. The report and execution checks remain separate: their joint success does not invent the unproven stock HTTP connector.
make vulnerable
make report # expected: raw tag preserved, no execution guard
make probe # expected: execution_observed=true and exit 0
make patched
make report # expected: exit guard present, payload tag neutralized
make probe # expected: execution_observed=false and exit 2
make probe returning 2 in the patched state is the expected negative result;
make ab handles both exit statuses and returns 0 only when the full A/B passes.
This check never starts Magento or executes code from the mounted tree. The container has no network, no Linux capabilities, a read-only root filesystem, and a read-only target mount.
make validate TARGET=/absolute/path/to/magento
Expected fully patched verdict:
Summary: 9/9 controls present
Verdict: FULL_CONTROL_SET_PRESENT
Anything less is reported as FULL_CONTROL_SET_NOT_CONFIRMED, not automatically
as exploitable. Confirm the exact Commerce edition/version and apply Adobe's
version-matched patch through its supported deployment process.
The more exact name is marker-only component code-execution probe. End-to-end remote RCE requires a stock remote request to produce its own independent marker or callback on the tested build.
See Technical notes for the data flow, nine patch controls, and the proof-strength table. The exact tested results are recorded in VALIDATION.md.
Use the official bulletin and the patch matching the deployed release:
The patch embedded here is path-mapped only for the public 2.4.9 monorepo lab. Do not apply it directly to a production Composer installation. Patching also does not remove an already present implant or restore exposed credentials.
make down # preserve volumes
make reset # delete this lab's source, database, and OpenSearch volumes