CVE-2026-53787 Details

A vulnerability allowing unauthenticated arbitrary file uploads has been identified in the Amasty Order Attributes extension for Magento 2, affecting versions prior to 4.0.0. This vulnerability allows attackers to upload files of any type or name to the store's media directory without authentication, session validation, or cart context. Exploitation of this vulnerability could lead to remote code execution on servers where the media directory allows PHP execution, or could be used to host malware, inject stored cross-site scripting via HTML or SVG uploads, and perform path traversal to write files outside the designated upload directory.

Users are advised to update the Amasty Order Attributes extension for Magento 2 to version 4.0.0 or later. This version includes a fix for the vulnerability by validating uploads, enforcing an extension allow-list, and requiring a real file attribute. Stores that cannot patch immediately should consider deploying Sansec Shield to block upload attempts in real time.