Skip to content
CVE PROGRAM SOURCE RECORD9.3 Critical

CVE-2026-48356

Adobe Commerce | Unrestricted Upload of File with Dangerous Type (CWE-434)

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
adobe

Description

Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Adobe Adobe Commerce

Default version status: unaffected

  • 0 to ≤ 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, 2.4.4-p18affected
  • 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul, 2.4.5-2026-jul, 2.4.4-2026-julunaffected

Adobe Adobe Commerce B2B

Default version status: unaffected

  • 0 to ≤ 1.5.3, 1.5.2-p5, 1.4.2-p10, 1.3.4-p17, 1.3.3-p18affected
  • 1.5.3-2026-jul, 1.5.2-2026-jul, 1.4.2-2026-jul, 1.3.4-2026-jul, 1.3.3-2026-julunaffected

Adobe Magento Open Source

Default version status: unaffected

  • 0 to ≤ 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15affected
  • 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-julunaffected

Adobe Adobe Commerce Events

Default version status: unaffected

  • 0 to ≤ 1.20.0affected
  • 1.21.0unaffected

References