Adobe Commerce / Magento "PolyShell" Unauthenticated File Upload (CVE-2025-54263, CVE-2025-54264, CVE-2025-54265, CVE-2025-54266, CVE-2025-54267)
Description
Adobe Commerce and Magento Open Source contain an unauthenticated file upload vulnerability in the REST API guest cart endpoint. The API accepts arbitrary file uploads embedded as file_info objects within cart item custom options without validating the option ID against the product, without verifying that the product has a file-type option configured, and without restricting file extensions. Magento's ImageContentValidator checks only that the file has a valid image size and an accepted MIME type, but does not verify that the file extension matches the declared content. This allows an attacker to upload "polyglot" files that pass image validation while containing executable PHP code. Uploaded files are stored in the web-accessible pub/media/custom_options/quote/ directory. Exploited in the wild from March 2025 as the "PolyShell" campaign documented by Sansec.
Remediation
Apply the security patches provided by Adobe for bulletin APSB25-94 immediately. Consult Adobe Security Bulletin APSB25-94 for the specific patched versions applicable to your Adobe Commerce or Magento Open Source installation.
As an interim mitigation, configure your web server to deny execution of PHP and other scripting languages within the pub/media/ directory. For Apache, ensure that any .htaccess overrides in pub/media/ disable PHP execution. For Nginx, remove any PHP handler blocks that apply to the media path. Additionally, consider restricting the REST API guest cart endpoints at the WAF or network layer if guest checkout is not required.