LmCast :: Stay tuned in

New ‘PolyShell’ flaw allows unauthenticated RCE on Magento e-stores

Recorded: March 20, 2026, midnight

Original Summarized

New ‘PolyShell’ flaw allows unauthenticated RCE on Magento e-stores

News

Featured
Latest

ConnectWise patches new flaw allowing ScreenConnect hijacking

New DarkSword iOS exploit used in infostealer attack on iPhones

Apple pushes first Background Security Improvements update to fix WebKit flaw

GlassWorm malware hits 400+ code repos on GitHub, npm, VSCode, OpenVSX

Navia discloses data breach impacting 2.7 million people

New ‘PolyShell’ flaw allows unauthenticated RCE on Magento e-stores

Get Luminar Neo lifetime access and a full bundle for just $79.99

Bitrefill blames North Korean Lazarus group for cyberattack

Tutorials

Latest
Popular

How to access the Dark Web using the Tor Browser

How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11

How to use the Windows Registry Editor

How to backup and restore the Windows Registry

How to start Windows in Safe Mode

How to remove a Trojan, Virus, Worm, or other Malware

How to show hidden files in Windows 7

How to see hidden files in Windows

Webinars
Downloads

Latest
Most Downloaded

Qualys BrowserCheck

STOPDecrypter

AuroraDecrypter

FilesLockerDecrypter

AdwCleaner

ComboFix

RKill

Junkware Removal Tool

Deals

Categories

eLearning

IT Certification Courses

Gear + Gadgets

Security

VPNs

Popular

Best VPNs

How to change IP address

Access the dark web safely

Best VPN for YouTube

Forums
More

Virus Removal Guides
Startup Database
Uninstall Database
Glossary
Send us a Tip!
Welcome Guide

HomeNewsSecurityNew ‘PolyShell’ flaw allows unauthenticated RCE on Magento e-stores

New ‘PolyShell’ flaw allows unauthenticated RCE on Magento e-stores

By Bill Toulas

March 19, 2026
04:01 PM
0

A newly disclosed vulnerability dubbed 'PolyShell' affects all Magento Open Source and Adobe Commerce stable version 2 installations, allowing unauthenticated code execution and account takeover.
There are no signs of the issue being actively exploited in the wild, but eCommerce security company Sansec warns that "the exploit method is circulating already" and expects automated attacks to start soon.
Adobe has released a fix, but it is only available in the second alpha release for version 2.4.9, leaving production versions vulnerable. Sansec says that Adobe offers  a "sample web server configuration that would largely limit the fallout," but most stores rely on a setup from their hosting provider.
In a report this week, Sansec says that the security problem is rooted in Magento's REST API accepting file uploads as part of the custom options for the cart item.
"When a product option has type 'file', Magento processes an embedded file_info object containing base64-encoded file data, a MIME type, and a filename. The file is written to pub/media/custom_options/quote/ on the server," the researchers explain.
Sansec says “PolyShell” is named after its use of a polyglot file that can behave as both an image and a script.
Depending on the web server configuration, the flaw can enable remote code execution (RCE) or account takeover via stored XSS, impacting most of the stores Sansec analyzed.
“Sansec investigated all known Magento and Adobe Commerce stores and found that many stores expose files in the upload directory.”
Until Adobe releases the patch to production versions, store administrators are recommended to take the following actions:
Restrict access to pub/media/custom_options/
Verify that nginx or Apache rules actually prevent access there
Scan stores for uploaded shells, backdoors, or other malware
BleepingComputer has contacted Adobe to ask about when a security update for PolyShell will be made available, but we have not heard back as of publishing.

Red Report 2026: Why Ransomware Encryption Dropped 38%
Malware is getting smarter. The Red Report 2026 reveals how new threats use math to detect sandboxes and hide in plain sight.Download our analysis of 1.1 million malicious samples to uncover the top 10 techniques and see if your security stack is blinded.
Download The Report

Related Articles:
WordPress plugin with 900k installs vulnerable to critical RCE flawConnectWise patches new flaw allowing ScreenConnect hijackingUK’s Companies House confirms security flaw exposed business dataVeeam warns of critical flaws exposing backup servers to RCE attacksSQLi flaw in Elementor Ally plugin impacts 250k+ WordPress sites

Adobe Commerce
E-Commerce
File Upload
Magento
PolyShell
Vulnerability

Bill Toulas
Bill Toulas is a tech writer and infosec news reporter with over a decade of experience working on various online publications, covering open-source, Linux, malware, data breach incidents, and hacks.

Previous Article
Next Article

Post a Comment Community Rules

You need to login in order to post a comment

Not a member yet? Register Now

You may also like:

Popular Stories

Stryker attack wiped tens of thousands of devices, no malware needed

Microsoft Exchange Online outage blocks access to mailboxes

GlassWorm malware hits 400+ code repos on GitHub, npm, VSCode, OpenVSX

Sponsor Posts

Cut VMware migration time by 60% with Acronis—move workloads faster, with less downtime.

Uncover shadow AI apps, users, and risky data sharing. Get started in 5 min.

Overdue a password health-check? Audit your Active Directory for free

Secure your AI agents without sacrificing speed.

Are refund fraud methods targeting your brand? You can monitor the underground for these threats.

Follow us:

Main Sections

News
Webinars
VPN Buyer Guides
SysAdmin Software Guides
Downloads
Virus Removal Guides
Tutorials
Startup Database
Uninstall Database
Glossary

Community

Forums
Forum Rules
Chat

Useful Resources

Welcome Guide
Sitemap

Company

About BleepingComputer
Contact Us
Send us a Tip!
Advertising
Write for BleepingComputer
Social & Feeds
Changelog

Terms of Use - Privacy Policy - Ethics Statement - Affiliate Disclosure

Copyright @ 2003 - 2026 Bleeping Computer® LLC - All Rights Reserved

Login

Username

Password

Remember Me

Sign in anonymously

Sign in with Twitter

Not a member yet? Register Now


Reporter

Help us understand the problem. What is going on with this comment?

Spam

Abusive or Harmful

Inappropriate content

Strong language

Other

Read our posting guidelinese to learn what content is prohibited.

Submitting...
SUBMIT

A newly identified vulnerability, termed “PolyShell,” poses a significant risk to Magento e-commerce stores, specifically versions 2.4.9 and earlier. The issue allows for unauthenticated remote code execution (RCE) and potential account takeover, a critical security concern for businesses utilizing the Magento platform. Sansec, a cybersecurity firm, flagged the issue, noting that an exploit method is already circulating and likely to trigger automated attacks. While Adobe has released a patch for the second alpha release of version 2.4.9, this leaves production environments exposed until the update is broadly deployed.

The root cause of the vulnerability lies within Magento’s REST API and its handling of custom options for cart items. Specifically, the API accepts file uploads, which are then processed as ‘file’ type product options. This triggers the creation of a file_info object containing base64-encoded file data, a MIME type, and the filename, ultimately writing these files to the ‘pub/media/custom_options/quote’ directory on the server. Sansec researchers named the exploit “PolyShell” due to its utilization of a polyglot file capable of functioning as both an image and a script, adding to its deceptive nature.

The impact of the PolyShell flaw is substantial, potentially enabling RCE or account takeover via stored cross-site scripting (XSS) depending on the web server configuration. Sansec’s investigation revealed that many Magento stores expose files within this upload directory, amplifying the potential damage. The firm recommends immediate action for Magento store administrators until a comprehensive patch is available. These actions include restricting access to the ‘pub/media/custom_options/’ directory, verifying that Nginx or Apache rules effectively block access there, and scanning stores for malicious files such as shells, backdoors, or other malware.

As of the report’s publication, Adobe has not yet responded to repeated requests for information regarding the timeline for releasing a security update for PolyShell to production environments. The potential for continued vulnerability underscores the urgency of implementing the recommended security measures. This situation highlights the ongoing importance of rigorous security practices within Magento deployments and the need for proactive monitoring and response to rapidly emerging threats.