EUVD-2026-36430
GHSA-mgg8-gq8g-gq88
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network-reachable upload endpoint with no user interaction; arbitrary file write yields RCE on typical Magento deployments, so C/I/A all High.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
Amasty Order Attributes for Magento 2 before version 4.0.0 contains an unauthenticated arbitrary file upload vulnerability that allows unauthenticated attackers to write arbitrary files to the store's media directory by submitting files of any type or name to the upload endpoint without authentication, session validation, or cart context. Attackers can upload PHP files to achieve remote code execution on servers where the media directory permits PHP execution, or alternatively enable malware hosting, stored cross-site scripting via HTML or SVG uploads, and path traversal to write files outside the intended upload directory.
Articles & Coverage 2
AnalysisAI
Unauthenticated arbitrary file upload in Amasty Order Attributes for Magento 2 before 4.0.0 lets remote attackers drop arbitrary files into the store's media directory without authentication, session validation, or cart context. Where the media directory permits PHP execution, this escalates to unauthenticated remote code execution; otherwise it enables stored XSS via HTML/SVG, malware hosting, and path-traversal writes outside the intended directory. No public exploit identified at time of analysis, but the CVSS 4.0 base score of 9.3 and trivial preconditions make this a high-priority issue for any Magento 2 store running the extension.
Technical ContextAI
Amasty Order Attributes is a third-party Magento 2 (Adobe Commerce) extension that lets merchants attach custom fields - including file attachments - to orders at checkout. The flaw is a classic CWE-434 Unrestricted Upload of File with Dangerous Type: the controller backing the upload endpoint accepts multipart submissions without verifying the customer session, cart token, file extension, MIME type, or destination path. Magento stores uploaded customer assets under pub/media, which on many Apache/Nginx-PHP-FPM deployments is web-reachable; if PHP handlers are not explicitly disabled for that path (a common misconfiguration), any uploaded .php file becomes executable. The reported path-traversal aspect indicates the filename parameter is also used to construct the destination, allowing writes outside the intended subdirectory of pub/media. The CPE cpe:2.3:a:amasty:order_attributes_for_magento_2:*:*:*:*:*:*:*:* covers all versions of the extension prior to the fixed 4.0.0 release.
RemediationAI
Vendor-released patch: upgrade Amasty Order Attributes for Magento 2 to version 4.0.0 or later via Composer or the Amasty marketplace, then run bin/magento setup:upgrade and clear caches; consult the Sansec research at https://sansec.io/research/amasty-order-attributes-file-upload and the VulnCheck advisory at https://www.vulncheck.com/advisories/amasty-order-attributes-for-magento-2-unauthenticated-arbitrary-file-upload for indicators. If immediate upgrade is not possible, block the extension's upload endpoint at the web server or WAF (rules matching the Order Attributes upload controller path under /orderattributes/), disable PHP execution under pub/media by ensuring the Magento-shipped pub/media/.htaccess (Apache) or an equivalent nginx location block denies .php handling - accepting that this is generic Magento hardening and not a complete fix because XSS, SVG, and path-traversal writes remain possible - and audit pub/media for unexpected .php, .phtml, .html, and .svg files plus webserver logs for POSTs to the affected endpoint. Side effect of disabling the endpoint: customers will be unable to attach files to orders until the patch is applied.
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
NetAlertX (formerly PiAlert) versions 23.01.14 through 24.x before 24.10.12 allow unauthenticated command injection thro
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
Share
External POC / Exploit Code
Leaving vuln.today