Advisory (स्रोत मैप से)

Magento email template filter signing str_replace; Email Preview styles; ArrayScanner::collectEntities include. Hotfix VULN-39341.

Entry

• Method: POST
• Path: /graphql
• Router: Unauthenticated GraphQL. Store header logged unescaped. Guest cart billing SSTI smuggles Preview block. Payflow decline renders email and includes styles.first log path.
• Notes: Unauthenticated CVE-2026-75650 CWE-1336 Magento 2.4.8-p5. Witness: GHSA75650-WITNESS in handlePayflowProResponse body. Not eval. Not a reverse shell.

Call chain

• POST /graphql Store: <?= "GHSA75650-WITNESS" ?> logs into var/log/system.log
• createEmptyCart + setGuestEmailOnCart + setBillingAddressOnCart with nested {{var}}/{{block Preview}}
• POST /graphql?text=ColumnSet&styles={first:../var/log/system.log,...}&type=2 handlePayflowProResponse declined
• Preview processes styles; ArrayScanner::collectEntities include()s the log

Lab preconditions

• Magento Open Source / Adobe Commerce 2.4.4-2.4.9 without VULN-39341
• GraphQL storefront reachable

Witness

handlePayflowProResponse HTTP body contains GHSA75650-WITNESS from included system.log.

Not success

• eval/base64/system payload
• reverse shell
• patched VULN-39341

Patch / remediation

Do this first: Update Magento Open Source to VULN-39341 / APSB26-146 or newer.

Verify after upgrade

• Re-run CVE-2026-75650-Abraxas-Labs.py against the patched build: the mapped witness must not appear.
• Confirm the vendor advisory / changeset in the deployed tree (see references).
• A WAF signature is delay, not a patch.

If you cannot update immediately

• Disable or isolate the affected component.
• Hunt for the witness condition on production (new privileged users, unexpected files, injected rows — whatever this CVE's map names).

Reproduction (authorized lab)

Target only http://127.0.0.1:8088 (or the loopback you bound). Do not point this script at the internet.

Success is the witness above in the response body. Generic 200 HTML is not it.

Lab images

Loopback stack used to reproduce. Official images unless a Dockerfile in this folder builds from source.

• lab/docker-compose.yml
• lab/Dockerfile
• lab/run.sh
• lab/setup-magento.sh

Bind the vulnerable product tree next to Compose if the YAML mounts a local directory (plugin zip / source tag from the version table). Publish nothing except 127.0.0.1.

References

• CVE-2026-75650 · NVD

• CVE-2026-75650 · CVE.org

• helpx.adobe.com/security/products/magento/apsb26-146.html

• sansec.io/research/stylesmuggler-0day

• www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-75650

• www.cve.org/CVERecord?id=CVE-2026-75650

• Abraxas Labs: abraxaslabs.tech · github.com/abraxas · @abraxas_null

Records (structured)

License

This disclosure pack is licensed under the GNU Affero General Public License v3.0. See LICENSE.

Disclaimer

This pack is for the vendor, the site owner, and licensed labs. The script talks to 127.0.0.1. Using it against systems you do not own is not authorized by Abraxas Labs. No warranty.

abraxaslabs.tech · github.com/abraxas · @abraxas_null