PolyShell: unrestricted file upload in Magento and Adobe Commerce
Published
On 17 March 2026 Sansec published PolyShell: an unrestricted file upload affecting every production version of Magento Open Source and Adobe Commerce up to 2.4.9-alpha2. Under the right conditions it results in unauthenticated remote code execution.
Vendor fix initially limited to a 2.4.9 pre-release
What does this flaw actually do?
Magento’s REST API accepts file uploads as part of cart item custom options. When a product option is of type "file", Magento processes the embedded file server-side.
The PolyShell name comes from the polyglot file used: a perfectly valid GIF or PNG that also carries executable PHP. The file is written to `pub/media/custom_options/quote/`, where it may be executed, or used for stored XSS, if web server protections are not properly enforced.
What did attackers drop?
Sansec observed active exploitation from 16 March 2026, the day before disclosure, then automated mass scanning three days later.
The observed payloads: a PHP webshell running arbitrary code, and a password-protected execution shell passing commands straight to `system()`. In other words, permanent admin access to the server, independent of Magento.
Why is the vendor fix not enough?
Adobe released a fix, but it was initially available only in the second alpha pre-release of 2.4.9. Production versions stayed exposed.
This is the textbook case for a virtual patch: the flaw is public, mass-exploited, and the official fix cannot be installed on a production store. Waiting is not a strategy.
What should you do now?
Forbid PHP execution in `pub/media` at the web server level. It is the highest-value item on this list, and it holds for every file upload flaw, not just PolyShell.
Audit `pub/media/custom_options/quote/`: look for image files containing code, not only `.php` files. A store exposed since March may already host a shell.
Who is affected?
- Magento Open Source and Adobe Commerce: every production version up to 2.4.9-alpha2
- Vendor fix initially available only in the 2.4.9-alpha2 pre-release
- Active exploitation observed since 16 March 2026, mass scanning from 19 March
- Reference Adobe bulletin: APSB25-94
How does AtriShield stop it?
Virtual patch (Business and Enterprise): the flaw is neutralised at the entrance of your server, without changing your application and without waiting for a maintenance window. Security metadata is reported to your console.
- ✓Virtual patch on the REST API: cart item option file uploads are filtered at the edge.
- ✓Image + PHP polyglots are detected and rejected before anything is written to `pub/media`.
- ✓Protection available even when the vendor fix exists only in a pre-release.
- ✓Webshells dropped before activation are not removed: a media directory audit is still required.
Sources
Analysis published by Atrilya Solutions, based on public security reporting. The links above point to the original sources.