CVE-2026-53787: unauthenticated file upload in Amasty Order Attributes
Published
On 12 June 2026 Amasty shipped version 4.0.0 of its Order Attributes extension for Magento 2. It fixes CVE-2026-53787, an unauthenticated arbitrary file upload rated 9.8 out of 10. Sansec blocked the first exploitation attempt the same day.
Fixed by the vendor (Amasty Order Attributes 4.0.0, 12 June 2026)
What does this flaw actually do?
The extension exposes a file upload endpoint meant for attachments a customer adds during checkout. That endpoint checks neither caller identity, nor session state, nor association with a valid cart.
The result: anyone can drop any file, under any name. If the media directory allows PHP execution, the upload becomes remote code execution. If not, you are left with stored XSS via HTML or SVG, malware hosting, and path traversal to write outside the intended directory.
How did the exploitation unfold?
Sansec blocked the first attempt on 12 June 2026, hours after the fix was published. Mass scanning started on 14 June.
By 15 June, more than 12,000 exploitation attempts had been blocked, aimed at roughly a quarter of all Magento stores. Three days between a published fix and an industrialised campaign.
Why are my extensions my real attack surface?
Magento core is not the only way in. An average store carries dozens of third-party extensions, each with its own patch cadence, its own code quality and its own team, sometimes a single person.
You control neither those vendors’ calendars nor the delay between discovery and fix. What you can control is what reaches your application.
What should you do now?
Move Amasty Order Attributes to 4.0.0 or later. Then audit the media directory: a file dropped before the update is still there afterwards.
Check that your web server does not execute PHP from upload directories. That is the barrier that turns a critical flaw into a nuisance.
Who is affected?
- Amasty Order Attributes for Magento 2, versions ≤ 3.16.0
- Fixed in version 4.0.0, released 12 June 2026
- CVSS: 9.8 (critical). Unauthenticated upload, code execution possible
- More than 12,000 attempts blocked as of 15 June 2026
How does AtriShield stop it?
Virtual patch (Business and Enterprise): the flaw is neutralised at the entrance of your server, without changing your application and without waiting for a maintenance window. Security metadata is reported to your console.
- ✓Virtual patch on the upload endpoint: unauthenticated requests are refused before they reach Magento.
- ✓Polyglot files and executable extensions are rejected before anything hits the disk.
- ✓Coverage extends to third-party extensions, not just Magento core.
- ✓Also useful when the extension upgrade breaks a business flow and has to be tested first.
Sources
Analysis published by Atrilya Solutions, based on public security reporting. The links above point to the original sources.