Magento PolyShell Flaw Enables Unauthenticated Uploads, RCE and Account Takeover

Magento PolyShell Flaw Enables Unauthenticated Uploads, RCE and Account Takeover Ravie LakshmananMar 20, 2026Web Security / Vulnerability Sansec is warning of a critical security flaw in Magento's REST API that could allow unauthenticated attackers to upload arbitrary executables and achieve code execution and account takeover. The vulnerability has been codenamed PolyShell by Sansec owing to the fact that the attack hinges on disguising malicious code as an image. There is no evidence that the shortcoming has been exploited in the wild. The unrestricted file upload flaw affects all Magento Open Source and Adobe Commerce versions up to 2.4.9-alpha2. The Dutch security firm said the problem stems from the fact that Magento's REST API accepts file uploads as part of the custom options for the cart item. "When a product option has type 'file,' Magento processes an embedded file_info object containing base64-encoded file data, a MIME type, and a filename," it said. "The file is written to pub/media/custom_options/quote/ on the server." Depending on the web server configuration, the flaw can enable remote code execution via PHP upload or account takeover via stored XSS. Sansec also noted that Adobe fixed the issue in the 2.4.9 pre-release branch as part of APSB25-94, but leaves current production versions without an isolated patch. "While Adobe provides a sample web server configuration that would largely limit the fallout, the majority of stores use a custom configuration from their hosting provider," it added. To mitigate any potential risk, e-commerce storefronts are advised to perform the following steps - Restrict access to the upload directory ("pub/media/custom_options/"). Verify that nginx or Apache rules prevent access to the directory. Scan the stores for web shells, backdoors, and other malware. "Blocking access does not block uploads, so people will still be able to upload malicious code if you aren't using a specialized WAF [Web Application Firewall]," Sansec said. The development comes as Netcraft flagged an ongoing campaign involving the compromise and defacement of thousands of Magento e-commerce sites across multiple sectors and geographies. The activity, which commenced on February 27, 2026, involves the threat actor uploading plaintext files to publicly accessible web directories. "Attackers have deployed defacement txt files across approximately 15,000 hostnames spanning 7,500 domains, including infrastructure associated with prominent global brands, e-commerce platforms, and government services," security researcher Gina Chow said. It's currently not clear if the attacks are exploiting a specific Magento vulnerability or misconfiguration, and it's the work of a single threat actor. The campaign has impacted infrastructure belonging to several globally recognized brands, including Asus, FedEx, Fiat, Lindt, Toyota, and Yamaha, among others. The Hacker News has also reached out to Netcraft to understand if this activity has a connection to PolyShell, and we will update the story if we hear back. Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. SHARE     Tweet Share Share SHARE  Adobe Commerce, API Security, cybersecurity, Magento, Malware, remote code execution, Vulnerability, web security, xss Trending News Nine CrackArmor Flaws in Linux AppArmor Enable Root Escalation, Bypass Container Isolation Google Fixes Two Chrome Zero-Days Exploited in the Wild Affecting Skia and V8 ThreatsDay Bulletin: OAuth Trap, EDR Killer, Signal Phishing, Zombie ZIP, AI Platform Hack and More Apple Fixes WebKit Vulnerability Enabling Same-Origin Policy Bypass on iOS and macOS Critical n8n Flaws Allow Remote Code Execution and Exposure of Stored Credentials Android 17 Blocks Non-Accessibility Apps from Accessibility API to Prevent Malware Abuse Meta to Shut Down Instagram End-to-End Encrypted Chat Support Starting May 2026 Veeam Patches 7 Critical Backup and Replication Flaws Allowing Remote Code Execution Apple Issues Security Updates for Older iOS Devices Targeted by Coruna WebKit Exploit CISA Flags Actively Exploited Wing FTP Vulnerability Leaking Server Paths Microsoft Patches 84 Flaws in March Patch Tuesday, Including Two Public Zero-Days Researchers Trick Perplexity's Comet AI Browser Into Phishing Scam in Under Four Minutes ⚡ Weekly Recap: Chrome 0-Days, Router Botnets, AWS Breach, Rogue AI Agents and More Six Android Malware Families Target Pix Payments, Banking Apps, and Crypto Wallets FortiGate Devices Exploited to Breach Networks and Steal Service Account Credentials OpenClaw AI Agent Flaws Could Enable Prompt Injection and Data Exfiltration Chinese Hackers Target Southeast Asian Militaries with AppleChris and MemFun Malware Load More ▼ Popular Resources Get the 2026 ASV Report to Benchmark Top Validation Tools Guide - Discover How to Validate AI Risks With Adversarial Testing Webinar - Identify Key Attack Paths to Your Crown Jewels with CSMA Fix Security Noise by Focusing Only on Validated Exposures