CRITICAL🇵🇱 Wersja polska

CVE-2026-48356

CVSS 9.3v3.1pub. 2026-07-14upd. 2026-08-28

Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

  • Adobe Commerce

    APP
    Adobe
    2.4.42.4.52.4.62.4.72.4.82.4.9

  • Adobe Commerce B2b

    APP
    Adobe
    1.3.31.3.41.4.21.5.21.5.3

  • Adobe I\/o Events

    APP
    Adobe
    1.6.0 – 1.21.0 (excl.)

  • Adobe Magento

    APP
    Adobe
    2.4.62.4.72.4.82.4.9
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
RCE
CWE
References

Related vulnerabilities

CVE-2025-54236CRITICAL9.1⚠ KEVPL ✓same product

Adobe Commerce/Magento — przejęcie sesji przez Improper Input Validation

CVE-2024-34102CRITICAL9.8⚠ KEVPL ✓same product

Krytyczna podatność XXE w Adobe Commerce umożliwiająca RCE

CVE-2022-24086CRITICAL9.8⚠ KEVPL ✓same product

Adobe Commerce — RCE przez błędną walidację danych podczas checkout

CVE-2026-48358CRITICAL9.1PL ✓same product

RCE w Adobe Commerce — błąd kodowania wyjścia (CVE-2026-48358)

CVE-2025-24434CRITICAL9.1PL ✓same product

Adobe Commerce — Incorrect Authorization umożliwiające privilege escalation