PolyShell: file upload vulnerability in Magento 2 under mass exploitation

On 17 March 2026, Sansec disclosed a vulnerability in Magento 2 and Adobe Commerce, now tracked as CVE-2026-48356, which Sansec calls PolyShell. It has been actively exploited since 19 March.

Two guest cart endpoints of the REST API allow uploading files without logging in. Attackers use files that are valid both as an image and as a PHP script (hence "poly"). Whether this leads to executable code on the server depends on the web server configuration. Either way, foreign files end up in pub/media/custom_options/. The GraphQL API is not affected.

All versions up to and including 2.4.9-alpha2 are affected. At the time of disclosure there was no patch for production versions.

1. List uploaded files: find pub/media/custom_options/ -type f ! -name '.htaccess'. Files ending in .php, .phtml or .phar are a clear sign of an attack.
2. Look for the known backdoor: find /var/www -name 'accesson.php' -type f
3. Check CMS pages and blocks for foreign scripts.

• Block web access to pub/media/custom_options/. On nginx the rule has to come before any rule for .php files; on Apache the .htaccess in that directory has to switch PHP off.
• A web application firewall that blocks the affected API calls. Blocking the directory alone does not prevent the upload.
• The update as soon as it is available (see below), followed by another scan: files uploaded earlier stay on disk after patching.

Adobe fixed the vulnerability in Magento 2.4.9 on 12 May 2026 and backported the fix to the older supported release lines with bulletin APSB26-73 on 14 July 2026. According to Sansec, by mid-April upload attempts had been seen on about 82% of the shops they monitor.

I check shops for traces of PolyShell and set up the protective measures. Write to me.

Source: Sansec: PolyShell. As of March 2026, updated July 2026.