Adobe Commerce / Magento "PolyShell" Unauthenticated File Upload to Stored XSS (CVE-2025-54263, CVE-2025-54264, CVE-2025-54265, CVE-2025-54266, CVE-2025-54267)
Description
Adobe Commerce and Magento Open Source contain an unauthenticated file upload vulnerability in the REST API guest cart endpoint that leads to stored cross-site scripting. The API accepts arbitrary file uploads embedded as file_info objects within cart item custom options without validating the option ID against the product, without verifying that the product has a file-type option configured, and without restricting file extensions. Magento's ImageContentValidator checks only that the file has a valid image size and an accepted MIME type, but does not verify that the file extension matches the declared content. This allows an attacker to upload "polyglot" files that pass image validation while containing an HTML/JavaScript payload. Uploaded files are stored in the web-accessible pub/media/custom_options/quote/ directory. When the web server is configured to serve these files (for example when pub/media/custom_options/.htaccess has been removed), a polyglot uploaded with an .html extension is returned with a text/html content type and its embedded script executes in the browser of any victim who is directed to the file, resulting in stored cross-site scripting from the store's own origin.
Remediation
Apply the security patches provided by Adobe for bulletin APSB25-94 immediately. Consult Adobe Security Bulletin APSB25-94 for the specific patched versions applicable to your Adobe Commerce or Magento Open Source installation.
As an interim mitigation, restore or retain the .htaccess restrictions in pub/media/ and pub/media/custom_options/ so that uploaded files cannot be served or executed, and configure your web server to serve files from the media directory with a safe, non-renderable content type (for example by forcing Content-Disposition: attachment). Additionally, consider restricting the REST API guest cart endpoints at the WAF or network layer if guest checkout is not required.