CVE-2026-48356
CriticalCVSS 9.3Exploitation Probability (EPSS)
Very high risk98th percentile - higher than 98% of all known CVEs
Summary
Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user. This could allow an attacker to gain elevated access or control over the victim's account or session. Exploitation requires user interaction, such as visiting a maliciously crafted URL or interacting with a compromised web page.
Risk Assessment
The risk for the organization includes potential account takeover and privilege escalation, which could lead to data theft, content modification, or further attacks on systems.
Recommendation
It is recommended to immediately update Adobe Commerce to the latest available version that includes a fix for this vulnerability. Additionally, restrict file upload capabilities for untrusted users.
Original NVD description (English source)
Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.