abraxas/cve-2026-48356Proof-of-concept and lab pack for CVE-2026-48356, an unauthenticated unrestricted file upload in Magento Open Source guest-cart REST custom options.
abraxaslabs.tech · github.com/abraxas · @abraxas_null · [email protected] · CVE-2026-48356
Magento Open Source 2.4.8-p5 - Adobe
I am @abraxas_null. Loopback lab. CVE-2026-48356-Abraxas-Labs.py chdirs into lab/ and runs run.sh.
PolyShell. Unauthenticated guest-cart REST accepts file_info that is a GIF89a polyglot with a .php name. ImageContentValidator looks at getimagesizefromstring and punctuation, then ImageProcessor::getFileName keeps the caller extension. The file lands under pub/media/custom_options/quote/. Lab pin 2.4.8-p5. Hotfix APSB26-73 / 2.4.8-2026-jul.
| CVE | CVE-2026-48356 · CVE.org |
| CWE | CWE-434 |
| CVSS | Critical: 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N |
| Product | Magento Open Source |
| Affected | all versions through 2.4.8-p5 (inclusive) |
| Patched | 2.4.8-2026-jul / APSB26-73 and later |
| Auth | unauthenticated |
| License | GNU Affero GPL v3.0 |
| Lab | 127.0.0.1 only |
Create a guest cart. POST an item with custom-option file_info named *.php and a GIF header. The add-to-cart JSON echoes the written filename. Anyone who can then hit that media path runs PHP as the Magento user. The lab oracle is the filename in the JSON, not a shell.
I mapped ImageContentValidator::isValid and the guest-cart option file processor. No option_id / option-type check on that REST path. Then I stood up the loopback stack with a salable simple SKU and ran the client.
Fail-controls already in the lab: eval/base64/system is not the witness; a reverse shell is not the witness; APSB26-73 applied must not print GHSA48356-WITNESS.php.
Port 18096. Magento Open Source 2.4.8-p5 without APSB26-73. REST guest-carts reachable. seed-product.sh plants lab-sku.
lab/Dockerfilelab/docker-compose.ymllab/poc.pylab/run.shlab/seed-product.shlab/setup-magento.shTarget only 127.0.0.1:18096 (or the loopback you bound).
python3 CVE-2026-48356-Abraxas-Labs.py
Witness: Guest-cart add-item HTTP JSON contains GHSA48356-WITNESS.php.
Ways to lose without learning anything:
Update Magento Open Source / Adobe Commerce to 2.4.8-2026-jul / APSB26-73 or newer. Re-run CVE-2026-48356-Abraxas-Labs.py against the patched build: GHSA48356-WITNESS.php must not appear.
Abraxas Labs: abraxaslabs.tech · github.com/abraxas · @abraxas_null
GNU Affero GPL v3.0. See LICENSE.
The client talks to loopback. Using it against systems you do not own is not authorized by Abraxas Labs. No warranty.