CVE-2026-48356
Modified Modified - Updated After Analysis

Unrestricted File Upload in Adobe Commerce

Publication date: 2026-07-14

Last updated on: 2026-07-29

Assigner: Adobe Systems Incorporated

Description
Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-14
Last Modified
2026-07-29
Generated
2026-08-04
AI Q&A
2026-07-15
EPSS Evaluated
2026-08-02
NVD
CVE-2026-48356
EUVD
EUVD-2026-44420

Affected Vendors & Products

Showing 171 associated CPEs
Vendor Product Version / Range
adobe commerce 2.4.4
adobe commerce 2.4.5
adobe commerce 2.4.4
adobe commerce 2.4.5
adobe commerce 2.4.4
adobe commerce 2.4.5
adobe commerce 2.4.4
adobe commerce 2.4.6
adobe commerce 2.4.4
adobe commerce 2.4.5
adobe commerce 2.4.6
adobe commerce 2.4.5
adobe commerce 2.4.4
adobe commerce 2.4.7
adobe commerce 2.4.5
adobe commerce 2.4.6
adobe commerce 2.4.6
adobe commerce 2.4.4
adobe commerce 2.4.4
adobe commerce 2.4.4
adobe commerce 2.4.4
adobe commerce 2.4.7
adobe commerce 2.4.7
adobe commerce 2.4.7
adobe commerce 2.4.6
adobe commerce 2.4.6
adobe commerce 2.4.6
adobe commerce 2.4.5
adobe commerce 2.4.5
adobe commerce 2.4.5
adobe commerce 2.4.7
adobe commerce 2.4.4
adobe commerce 2.4.5
adobe commerce 2.4.6
adobe commerce 2.4.7
adobe commerce 2.4.4
adobe commerce 2.4.8
adobe commerce 2.4.7
adobe commerce 2.4.6
adobe commerce 2.4.5
adobe commerce 2.4.4
adobe commerce 2.4.5
adobe commerce 2.4.6
adobe commerce 2.4.7
adobe commerce 2.4.8
adobe commerce 2.4.7
adobe commerce 2.4.8
adobe commerce 2.4.4
adobe commerce 2.4.5
adobe commerce 2.4.6
adobe commerce 2.4.4
adobe commerce 2.4.5
adobe commerce 2.4.6
adobe commerce 2.4.7
adobe commerce 2.4.8
adobe commerce 2.4.9
adobe commerce 2.4.4
adobe commerce 2.4.5
adobe commerce 2.4.6
adobe commerce 2.4.7
adobe commerce 2.4.8
adobe commerce 2.4.4
adobe commerce 2.4.5
adobe commerce 2.4.6
adobe commerce 2.4.7
adobe commerce 2.4.8
adobe commerce 2.4.8
adobe commerce 2.4.7
adobe commerce 2.4.6
adobe commerce 2.4.6
adobe commerce 2.4.5
adobe commerce 2.4.4
adobe commerce 2.4.4
adobe commerce 2.4.5
adobe commerce 2.4.7
adobe commerce 2.4.8
adobe commerce_b2b 1.4.2
adobe commerce_b2b 1.4.2
adobe commerce_b2b 1.4.2
adobe commerce_b2b 1.3.4
adobe commerce_b2b 1.3.4
adobe commerce_b2b 1.3.3
adobe commerce_b2b 1.3.3
adobe commerce_b2b 1.4.2
adobe commerce_b2b 1.3.4
adobe commerce_b2b 1.3.3
adobe commerce_b2b 1.3.3
adobe commerce_b2b 1.3.3
adobe commerce_b2b 1.3.3
adobe commerce_b2b 1.3.3
adobe commerce_b2b 1.3.3
adobe commerce_b2b 1.3.3
adobe commerce_b2b 1.3.3
adobe commerce_b2b 1.3.3
adobe commerce_b2b 1.3.3
adobe commerce_b2b 1.3.3
adobe commerce_b2b 1.3.4
adobe commerce_b2b 1.3.4
adobe commerce_b2b 1.3.4
adobe commerce_b2b 1.3.4
adobe commerce_b2b 1.3.4
adobe commerce_b2b 1.3.4
adobe commerce_b2b 1.3.4
adobe commerce_b2b 1.3.4
adobe commerce_b2b 1.3.4
adobe commerce_b2b 1.4.2
adobe commerce_b2b 1.3.3
adobe commerce_b2b 1.3.4
adobe commerce_b2b 1.4.2
adobe commerce_b2b 1.5.2
adobe commerce_b2b 1.3.3
adobe commerce_b2b 1.3.4
adobe commerce_b2b 1.4.2
adobe commerce_b2b 1.5.2
adobe commerce_b2b 1.3.3
adobe commerce_b2b 1.3.4
adobe commerce_b2b 1.4.2
adobe commerce_b2b 1.5.2
adobe commerce_b2b 1.3.3
adobe commerce_b2b 1.3.4
adobe commerce_b2b 1.4.2
adobe commerce_b2b 1.5.2
adobe commerce_b2b 1.5.2
adobe commerce_b2b 1.4.2
adobe commerce_b2b 1.3.3
adobe commerce_b2b 1.3.4
adobe commerce_b2b 1.3.3
adobe commerce_b2b 1.3.4
adobe commerce_b2b 1.4.2
adobe commerce_b2b 1.5.2
adobe commerce_b2b 1.5.3
adobe magento 2.4.6
adobe magento 2.4.6
adobe magento 2.4.6
adobe magento 2.4.7
adobe magento 2.4.6
adobe magento 2.4.6
adobe magento 2.4.6
adobe magento 2.4.7
adobe magento 2.4.7
adobe magento 2.4.7
adobe magento 2.4.6
adobe magento 2.4.7
adobe magento 2.4.6
adobe magento 2.4.7
adobe magento 2.4.8
adobe magento 2.4.7
adobe magento 2.4.6
adobe magento 2.4.6
adobe magento 2.4.7
adobe magento 2.4.8
adobe magento 2.4.6
adobe magento 2.4.7
adobe magento 2.4.8
adobe magento 2.4.6
adobe magento 2.4.7
adobe magento 2.4.8
adobe magento 2.4.6
adobe magento 2.4.7
adobe magento 2.4.8
adobe magento 2.4.6
adobe magento 2.4.7
adobe magento 2.4.8
adobe magento 2.4.6
adobe magento 2.4.7
adobe magento 2.4.8
adobe magento 2.4.6
adobe magento 2.4.7
adobe magento 2.4.8
adobe magento 2.4.9
adobe i/o_events From 1.6.0 (inc) to 1.21.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Adobe Commerce has an Unrestricted Upload of File with Dangerous Type vulnerability. This allows attackers to upload malicious files that can execute arbitrary code on the system. Exploitation requires user interaction, such as visiting a crafted URL or interacting with a compromised page.

Impact Analysis

An attacker could inject malicious scripts into web pages, potentially gaining control over your account or session. This could lead to unauthorized access, data theft, or further compromise of your system.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR and HIPAA requirements for data protection and security. Compliance may be compromised if sensitive data is exposed or altered.

Mitigation Strategies

Apply the latest security patches or updates from Adobe Commerce immediately. Review and restrict file upload functionality to prevent dangerous file types. Monitor network traffic for suspicious activity or interactions with maliciously crafted URLs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-48356. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart