{"type":"bundle","id":"bundle--46d784b4-d5aa-53b3-b41c-2eb62161b22c","objects":[{"type":"campaign","spec_version":"2.1","id":"campaign--4b386d1b-c9af-52e2-9618-482df1881bae","created":"2026-10-27T22:18:03.450Z","modified":"2026-10-27T22:18:03.450Z","name":"Magento PolyShell lets anyone upload a webshell through the guest cart REST API, now on CISA KEV (CVE-2026-48356)","description":"CVE-2026-48356, named PolyShell by Sansec, is an unrestricted file upload (CWE-434) in Adobe Commerce and Magento Open Source. The REST guest cart endpoints POST /rest/V1/guest-carts/:cartId/items and PUT /rest/V1/guest-carts/:cartId/items/:itemId accept a file_info object (base64 data, MIME type, filename) inside cart item custom options and write it to pub/media/custom_options/quote/. Sansec found that Magento did not check that the option ID belongs to the product, did not require a file-type option, and did not restrict the extension; the only gate was an image header check, so a GIF89a-prefixed PHP file passes. Whether the upload becomes remote code execution or stored XSS depends on whether the web server serves or executes files in that folder. Adobe fixed it in Magento 2.4.9 (May 2026) and backported the fix to supported lines in APSB26-73 on 2026-07-14 (CVSS 9.3). Sansec documented exploitation from March 2026, including 471 stores compromised in one hour on 2026-03-30 and a skimmer-loader crew that has used PolyShell uploads on Magento stores through October 2026. CISA added CVE-2026-48356 to the KEV catalog on 2026-10-27 with a 2026-11-10 due date.","aliases":["CVE-2026-48356","PolyShell","Magento PolyShell","Adobe Commerce PolyShell","APSB26-73","Magento guest cart file upload","CVE-2026-48356 CISA KEV"],"first_seen":"2026-03-17T00:00:00Z","last_seen":"2026-10-27T19:00:02Z","objective":"Defensive public threat-intelligence record; see limitations and source references.","external_references":[{"source_name":"Adobe APSB26-73: Security update available for Adobe Commerce","url":"https://www.adobe.com/trust/security/products/commerce/apsb26-73.html"},{"source_name":"NVD CVE-2026-48356","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48356"},{"source_name":"CISA KEV catalog entry for CVE-2026-48356","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48356"},{"source_name":"Sansec: PolyShell, unrestricted file upload in Magento and Adobe Commerce","url":"https://sansec.io/research/magento-polyshell"},{"source_name":"Sansec: Mass PolyShell attack wave hits 471 stores in one hour","url":"https://sansec.io/research/polyshell-mass-attack-wave"},{"source_name":"Sansec: deepveindrilling.com Magento CMS block loader hits 953 stores","url":"https://sansec.io/research/magento-cms-block-loader-deepveindrilling"},{"source_name":"Akamai: Magento PolyShell, the latest Magento threat","url":"https://www.akamai.com/blog/security-research/magento-polyshell-latest-magento-threat-apsb25-94"},{"source_name":"HOL: Magento PolyShell (CVE-2026-48356) is on CISA KEV","url":"https://hol.org/blog/cve-2026-48356-magento-polyshell-cisa-kev-webshell-upload"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--c20e6ead-1e76-5e11-9157-5a8de86d1f2c","created":"2026-10-27T22:17:54.587Z","modified":"2026-10-27T22:17:54.587Z","name":"Magento PolyShell lets anyone upload a webshell through the guest cart REST API, now on CISA KEV (CVE-2026-48356): domain","description":"Defanged indicator mapped from a reviewed HOL Guard campaign record.","indicator_types":["malicious-activity"],"pattern_type":"stix","pattern":"[domain-name:value = 'deepveindrilling[.]com']","valid_from":"2026-03-17T00:00:00Z"},{"type":"relationship","spec_version":"2.1","id":"relationship--36f0cfd5-52e0-5fe4-a8c4-958eb391192c","created":"2026-10-27T22:17:54.587Z","modified":"2026-10-27T22:17:54.587Z","relationship_type":"uses","source_ref":"campaign--4b386d1b-c9af-52e2-9618-482df1881bae","target_ref":"indicator--c20e6ead-1e76-5e11-9157-5a8de86d1f2c"},{"type":"indicator","spec_version":"2.1","id":"indicator--21791b6b-29f8-51c3-99bf-cfca0951c0ed","created":"2026-10-27T22:17:54.587Z","modified":"2026-10-27T22:17:54.587Z","name":"Magento PolyShell lets anyone upload a webshell through the guest cart REST API, now on CISA KEV (CVE-2026-48356): domain","description":"Defanged indicator mapped from a reviewed HOL Guard campaign record.","indicator_types":["malicious-activity"],"pattern_type":"stix","pattern":"[domain-name:value = 'lanhd6549tdhse[.]top']","valid_from":"2026-03-17T00:00:00Z"},{"type":"relationship","spec_version":"2.1","id":"relationship--1be3e9c6-5161-5f75-b0fb-5b3e003ec5bb","created":"2026-10-27T22:17:54.587Z","modified":"2026-10-27T22:17:54.587Z","relationship_type":"uses","source_ref":"campaign--4b386d1b-c9af-52e2-9618-482df1881bae","target_ref":"indicator--21791b6b-29f8-51c3-99bf-cfca0951c0ed"}]}