{
  "schemaVersion": "guard-threat-campaign/v1",
  "id": "HGTC-2026-A50559D9",
  "slug": "cve-2026-48356-magento-polyshell-cisa-kev-webshell-upload",
  "title": "Magento PolyShell lets anyone upload a webshell through the guest cart REST API, now on CISA KEV (CVE-2026-48356)",
  "aliases": [
    "CVE-2026-48356",
    "PolyShell",
    "Magento PolyShell",
    "Adobe Commerce PolyShell",
    "APSB26-73",
    "Magento guest cart file upload",
    "CVE-2026-48356 CISA KEV"
  ],
  "summary": "CVE-2026-48356, named PolyShell by Sansec, is an unrestricted file upload (CWE-434) in Adobe Commerce and Magento Open Source. The REST guest cart endpoints POST /rest/V1/guest-carts/:cartId/items and PUT /rest/V1/guest-carts/:cartId/items/:itemId accept a file_info object (base64 data, MIME type, filename) inside cart item custom options and write it to pub/media/custom_options/quote/. Sansec found that Magento did not check that the option ID belongs to the product, did not require a file-type option, and did not restrict the extension; the only gate was an image header check, so a GIF89a-prefixed PHP file passes. Whether the upload becomes remote code execution or stored XSS depends on whether the web server serves or executes files in that folder. Adobe fixed it in Magento 2.4.9 (May 2026) and backported the fix to supported lines in APSB26-73 on 2026-07-14 (CVSS 9.3). Sansec documented exploitation from March 2026, including 471 stores compromised in one hour on 2026-03-30 and a skimmer-loader crew that has used PolyShell uploads on Magento stores through October 2026. CISA added CVE-2026-48356 to the KEV catalog on 2026-10-27 with a 2026-11-10 due date.",
  "status": "published",
  "severity": "critical",
  "confidence": "high",
  "uncertainty": "CISA does not publish the evidence behind KEV entries. Adobe's APSB26-73 bulletin still states Adobe is not aware of exploits; exploitation evidence comes from Sansec's research. Remote code execution depends on web server configuration; on Adobe's sample nginx and Apache configs the uploaded file is not served. Store counts are Sansec's observations, not a census.",
  "firstObservedAt": "2026-03-17T00:00:00Z",
  "lastObservedAt": "2026-10-27T19:00:02Z",
  "publishedAt": "2026-10-27T22:18:03.450Z",
  "reviewedAt": "2026-10-27T22:17:54.587Z",
  "expiresAt": "2026-10-27T19:00:02Z",
  "reviewer": "HOL Guard Security Publishing",
  "sources": [
    {
      "id": "adobe-apsb26-73",
      "label": "Adobe APSB26-73: Security update available for Adobe Commerce",
      "url": "https://www.adobe.com/trust/security/products/commerce/apsb26-73.html",
      "sourceType": "vendor_advisory",
      "observedAt": "2026-07-14T00:00:00Z"
    },
    {
      "id": "nvd",
      "label": "NVD CVE-2026-48356",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48356",
      "sourceType": "vulnerability_database",
      "observedAt": "2026-07-14T20:17:08Z"
    },
    {
      "id": "cisa-kev",
      "label": "CISA KEV catalog entry for CVE-2026-48356",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48356",
      "sourceType": "government",
      "observedAt": "2026-10-27T19:00:02Z"
    },
    {
      "id": "sansec-polyshell",
      "label": "Sansec: PolyShell, unrestricted file upload in Magento and Adobe Commerce",
      "url": "https://sansec.io/research/magento-polyshell",
      "sourceType": "research",
      "observedAt": "2026-03-17T00:00:00Z"
    },
    {
      "id": "sansec-mass-wave",
      "label": "Sansec: Mass PolyShell attack wave hits 471 stores in one hour",
      "url": "https://sansec.io/research/polyshell-mass-attack-wave",
      "sourceType": "research",
      "observedAt": "2026-03-30T00:00:00Z"
    },
    {
      "id": "sansec-deepvein",
      "label": "Sansec: deepveindrilling.com Magento CMS block loader hits 953 stores",
      "url": "https://sansec.io/research/magento-cms-block-loader-deepveindrilling",
      "sourceType": "research",
      "observedAt": "2026-10-24T00:00:00Z"
    },
    {
      "id": "akamai",
      "label": "Akamai: Magento PolyShell, the latest Magento threat",
      "url": "https://www.akamai.com/blog/security-research/magento-polyshell-latest-magento-threat-apsb25-94",
      "sourceType": "research",
      "observedAt": "2026-10-27T19:00:02Z"
    },
    {
      "id": "hol-blog",
      "label": "HOL: Magento PolyShell (CVE-2026-48356) is on CISA KEV",
      "url": "https://hol.org/blog/cve-2026-48356-magento-polyshell-cisa-kev-webshell-upload",
      "sourceType": "other_primary",
      "observedAt": "2026-10-27T21:44:32Z"
    }
  ],
  "artifacts": [
    {
      "id": "magento-open-source",
      "artifactClass": "package",
      "ecosystem": "composer",
      "name": "magento/product-community-edition (Magento Open Source)",
      "version": "<=2.4.9, <=2.4.8-p5, <=2.4.7-p10, <=2.4.6-p15 (fixed in -2026-jul releases)",
      "defanged": false
    },
    {
      "id": "adobe-commerce",
      "artifactClass": "package",
      "ecosystem": "composer",
      "name": "Adobe Commerce",
      "version": "<=2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, 2.4.4-p18 (fixed in -2026-jul releases)",
      "defanged": false
    }
  ],
  "indicators": [
    {
      "id": "loader-deepveindrilling",
      "indicatorType": "domain",
      "value": "deepveindrilling[.]com",
      "defanged": true,
      "confidence": "high"
    },
    {
      "id": "loader-lanhd",
      "indicatorType": "domain",
      "value": "lanhd6549tdhse[.]top",
      "defanged": true,
      "confidence": "high"
    }
  ],
  "timeline": [
    {
      "id": "sansec-polyshell-disclosure",
      "occurredAt": "2026-03-17T00:00:00Z",
      "eventType": "disclosure",
      "summary": "Sansec publishes PolyShell research: unauthenticated file upload via the Magento REST guest cart API; no patch for production lines.",
      "sourceIds": [
        "sansec-polyshell",
        "akamai"
      ]
    },
    {
      "id": "sansec-mass-wave",
      "occurredAt": "2026-03-30T00:00:00Z",
      "eventType": "first_observed",
      "summary": "Sansec reports 471 stores compromised in one hour via PolyShell webshells followed by injected JavaScript loaders.",
      "sourceIds": [
        "sansec-mass-wave"
      ]
    },
    {
      "id": "adobe-apsb26-73",
      "occurredAt": "2026-07-14T00:00:00Z",
      "eventType": "vendor_action",
      "summary": "Adobe APSB26-73 assigns CVE-2026-48356 (critical, CVSS 9.3) and ships -2026-jul releases for supported lines.",
      "sourceIds": [
        "adobe-apsb26-73",
        "nvd"
      ]
    },
    {
      "id": "deepveindrilling-loader",
      "occurredAt": "2026-10-07T21:54:00Z",
      "eventType": "other",
      "summary": "Sansec observes the same crew moving its CMS block loader to deepveindrilling.com, mostly on stores it already controlled.",
      "sourceIds": [
        "sansec-deepvein"
      ]
    },
    {
      "id": "cisa-kev-add",
      "occurredAt": "2026-10-27T19:00:02Z",
      "eventType": "other",
      "summary": "CISA adds CVE-2026-48356 to the Known Exploited Vulnerabilities catalog (2026.10.27), due 2026-11-10.",
      "sourceIds": [
        "cisa-kev",
        "nvd"
      ]
    },
    {
      "id": "hol-kev-writeup",
      "occurredAt": "2026-10-27T21:44:32Z",
      "eventType": "other",
      "summary": "HOL publishes an operator write-up with patch, folder block and webshell hunt commands.",
      "sourceIds": [
        "hol-blog"
      ]
    }
  ],
  "coverage": [
    {
      "assertionId": "guard-not-storefront",
      "relationship": "not_covered",
      "limitation": "HOL Guard reviews AI coding agent actions on developer machines. It does not sit in front of Magento storefronts or block REST API uploads; the fix is the APSB26-73 update plus server cleanup."
    }
  ],
  "policies": [],
  "limitations": [
    "Stores on the APSB26-73 -2026-jul releases are not open to new PolyShell uploads but may still hold files uploaded before patching",
    "Magento GraphQL cart mutations use a different code path and are not the vulnerable entry point per R-fx Networks",
    "Servers that deny pub/media/custom_options/ and disable PHP there limit impact but still receive uploaded files",
    "The KEV due date of 2026-11-10 binds US federal civilian agencies only",
    "Deleting injected CMS scripts does not remove database or admin access the attacker already has"
  ],
  "correctionHref": "/guard/security/campaigns/cve-2026-48356-magento-polyshell-cisa-kev-webshell-upload/corrections"
}