PolyShell Flaw Exposes All Magento Stores to RCE Attacks

A newly disclosed vulnerability in Magento and Adobe Commerce allows unauthenticated attackers to upload executable files to any store—potentially leading to full server compromise. Researchers at Sansec dubbed it "PolyShell" because the attack uses polyglot files that appear to be images but execute as code.

The flaw affects all Magento Open Source and Adobe Commerce versions up to 2.4.9-alpha2. Adobe addressed it in the 2.4.9 pre-release branch as part of APSB25-94, but no isolated patch exists for current production versions.

That's a problem for the hundreds of thousands of stores running Magento 2.x in production right now.

How PolyShell Works

The vulnerability exists in Magento's REST API file upload functionality. When a product has a "file" type custom option, Magento processes an embedded file_info object containing base64-encoded file data, a MIME type, and a filename.

Sansec's research reveals that input validation is insufficient. Attackers can craft polyglot files—binary data that's valid as both an image and PHP code—and upload them through the API. The file lands in pub/media/custom_options/quote/ on the server.

What happens next depends on web server configuration:

Remote Code Execution: If the web server permits PHP execution in the upload directory, attackers can access their uploaded file directly and execute arbitrary code. This is full server compromise.

Stored XSS / Account Takeover: If PHP execution is blocked (as Adobe recommends), attackers can still upload malicious content that executes in user browsers, enabling session hijacking and admin account takeover.

Exploitation Status

Sansec reports no active exploitation observed yet, but the exploit method is already circulating. Given the value of ecommerce platforms as targets—payment data, customer PII, admin credentials—automated attacks will likely appear soon.

The combination of unauthenticated access and wide-reaching impact makes this vulnerability particularly attractive for mass exploitation campaigns. Similar patterns played out with previous Magento vulnerabilities that were weaponized within days of disclosure.

Who's Affected

Every Magento Open Source and Adobe Commerce installation running version 2.x is potentially vulnerable. The fix exists only in the pre-release 2.4.9 branch, leaving production deployments without an official patch.

Magento powers a significant portion of ecommerce infrastructure globally, including many enterprise deployments. Mid-market retailers running self-hosted Magento installations face the highest risk—they're large enough to be valuable targets but may lack dedicated security resources.

Mitigation Without a Patch

Since no production patch exists, organizations must implement workarounds:

1. Restrict access to the upload directory (pub/media/custom_options/) via web server configuration
2. Verify nginx or Apache rules prevent direct access to uploaded files
3. Implement WAF rules to inspect and block suspicious file uploads through the REST API
4. Monitor for web shells in the custom_options directory structure
5. Audit access logs for unusual POST requests to the REST API

Adobe's recommended server configuration should already prevent PHP execution in media directories. But "should" and "does" aren't the same thing—especially for stores that have been through multiple hosting migrations or configuration changes.

Checking Your Configuration

Test whether your installation is configured securely:

1. Verify your web server denies direct access to files in pub/media/custom_options/
2. Check that PHP execution is disabled in media directories
3. Review any custom nginx/Apache rules that might override default protections

If you're running Magento on managed hosting, confirm with your provider that these protections are in place. Some hosting configurations prioritize compatibility over security defaults.

Why This Matters

Ecommerce platforms remain high-value targets for multiple threat actors:

• Financial criminals seeking payment card data
• Credential stealers harvesting customer accounts for resale
• Web skimming groups injecting JavaScript payment snatchers
• Ransomware operators looking for leverage against retailers

A vulnerability that provides unauthenticated file upload to any Magento store is essentially a skeleton key for all of the above. The polyglot technique also complicates detection—standard file type validation won't catch files that are technically valid images.

We've seen similar supply chain and platform vulnerabilities exploited rapidly this year, from n8n automation flaws to attacks on development tools. Platforms with large install bases and delayed patch cycles are attractive targets precisely because the vulnerability window extends for weeks or months.

If you're running Magento, assume this is being weaponized now. Implement the mitigations above and monitor your logs closely until Adobe releases a production patch.

For ongoing ecommerce security guidance, the Adobe Commerce Security Best Practices documentation provides additional hardening recommendations.