A newly disclosed critical vulnerability dubbed PolyShell exposes all current versions of Magento Open Source and Adobe Commerce 2.x to unauthenticated file upload. According to research by Sansec, this flaw enables attackers to place arbitrary files on vulnerable servers, opening a direct path to remote code execution (RCE), stored cross‑site scripting (stored XSS) and ultimately takeover of administrator and customer accounts.
What is the PolyShell vulnerability in Magento and Adobe Commerce?
The root cause of PolyShell lies in the way the Magento REST API handles products with custom options of type file. When a buyer adds such a product to the cart via the API, the platform accepts a file_info object that contains a Base64‑encoded file, its MIME type and filename. After decoding, Magento stores the file in pub/media/custom_options/quote/ on the web server.
The critical issue is that this upload process is accessible without any authentication. An attacker does not need a customer account, API token or session. A correctly crafted REST request is enough to upload an arbitrary file into the store’s filesystem. What happens next depends heavily on the web server configuration and how static files are handled.
Polyglot files: from “image upload” to remote code execution
The name PolyShell references the use of polyglot files — specially constructed files that are valid in more than one format, for example both as an image and as executable script code. In insecure environments, such a file might be accepted and stored as an image, but when requested via its URL, the web server interprets it as executable code.
In practice, an attacker crafts a REST API request that mimics adding a product to the cart, embedding a Base64‑encoded polyglot payload in file_info. Magento stores the file under pub/media/custom_options/quote/. If the web server is misconfigured — for instance, allowing script execution in media directories or treating certain extensions as PHP — the uploaded file can act as a web shell. This provides the attacker with RCE, enabling installation of backdoors, tampering with payment flows and full manipulation of the ecommerce application.
Even when direct code execution is blocked, the same mechanism can be abused for stored XSS. Attackers can host malicious JavaScript in uploaded files and reference them from compromised templates or injected content, enabling session theft, credential harvesting and unauthorized actions in the admin interface.
Patch status, exploitation risk and business impact
Sansec reports that Adobe has acknowledged the issue and addressed it in security bulletin APSB25-94. At the time of writing, the fix is only available in a pre‑release branch of Adobe Commerce / Magento 2.4.9, with no dedicated security update yet shipped for the main production releases. This delay creates a high‑risk window of opportunity, especially as exploit techniques for PolyShell are already circulating in criminal communities.
RCE in the context of an online store is particularly severe. Once code execution is obtained, attackers can modify checkout logic, inject credit‑card skimmers, alter banking details, exfiltrate customer databases or pivot deeper into the hosting infrastructure. Stored XSS, while often perceived as less critical, can be used to hijack administrator sessions, plant persistent backdoors in templates and silently manipulate storefront content and pricing.
Mass Magento defacement campaign linked to file upload flaws
“Typical Idiot Security” and large‑scale website defacement
In parallel with the PolyShell disclosure, Netcraft has observed a large defacement campaign targeting Magento‑based sites. Since 27 February 2026, a threat actor or group has planted text defacement files on more than 7,500 websites, typically including the tag “Typical Idiot Security”. The same handle appears in submissions to the Zone‑H defacement archive, suggesting an attempt to build reputation in underground circles.
The affected sites include subdomains and regional storefronts of prominent brands such as Asus, BenQ, Citroën, Diesel, FedEx, Fiat, Lindt, Toyota, Yamaha, as well as governmental and academic domains. While simple content replacement may seem benign compared to full data theft, it demonstrates complete control over file placement on compromised servers and can be a precursor to more stealthy activities like skimming or lateral movement.
Links to unauthenticated file upload vulnerabilities
Netcraft’s analysis indicates that the defacements most likely leverage unauthenticated file upload vulnerabilities similar in nature to PolyShell. Researchers also highlight similarities with the SessionReaper flaw disclosed in late 2025, which abused weaknesses in Magento session handling and file upload mechanisms. The recurring pattern reinforces that insecure upload endpoints remain one of the most dangerous attack surfaces for ecommerce platforms.
How to protect Magento and Adobe Commerce from PolyShell‑style attacks
Until stable patches for all supported Magento and Adobe Commerce versions are released and deployed, store owners should implement a layered set of temporary hardening measures:
1. Restrict access to upload directories. Block direct web access to pub/media/custom_options/ at the nginx or Apache level (for example, with deny all or equivalent rules). Ensure that no scripts are executed from media directories, regardless of file extension or MIME type.
2. Scan for web shells and backdoors. Regularly inspect pub/media/custom_options/quote/ and other media folders for suspicious files: unusual extensions, random filenames or script content disguised as images. Use specialized web application security scanners and AV tools capable of detecting obfuscated shells and polyglot payloads.
3. Harden web server configuration. Enforce strict rules preventing execution of .php, .phtml and other executable formats in any upload or media directory. Configure the server to derive content type from trusted configuration, not solely from user‑supplied headers or file extensions.
4. Limit and monitor Magento REST API usage. Where feasible, restrict access to sensitive REST endpoints by IP allow‑listing or VPN, and deploy a Web Application Firewall (WAF) to detect and block anomalous file upload requests. Enable detailed logging for API calls and actively review logs for spikes or patterns related to file_info usage.
5. Plan immediate updates. As soon as Adobe releases final security updates for all affected branches, organizations should prioritize patching Magento and Adobe Commerce instances. Updates should first be validated in a staging environment, but unnecessary delays greatly increase the likelihood of compromise once exploit code is widely available.
The PolyShell vulnerability and the concurrent wave of Magento defacements underscore the systemic risk posed by unauthenticated file upload flaws in ecommerce platforms. Regular security assessments, conservative web server configurations, strict control over upload and API endpoints, and close monitoring of advisories from Sansec, Adobe and Netcraft are essential to reducing exposure. Organizations that act quickly to harden their environments and apply fixes will be far better positioned to keep their online stores — and their customers’ data — out of the next wave of mass compromises.
