CVE-2026-48356

This CVE presents as an unrestricted file upload leading to arbitrary code execution in Adobe Commerce, scored at CVSS 9.3 with the unusual 'Scope: Changed' designation. That scope change is the most important element — it signals that exploitation doesn't stay contained within the application's normal trust boundary. When a file upload achieves arbitrary code execution and the scope changes, you're looking at a trust boundary collapse that likely extends to the underlying host system or any other applications sharing that execution context. The user interaction requirement — a victim must visit a malicious URL — narrows the immediate attack surface but raises a critical question: how is this URL reaching the victim? This requirement often indicates the vulnerability chains with another vector (reflected XSS, a CSRF on the upload endpoint, or social engineering). Treat the interaction requirement as a barrier to opportunistic scanning, not a meaningful constraint against targeted attacks. The EPSS score of 0.28 indicates this is more likely to be actively exploited than most CVEs — track threat intelligence feeds for working exploits rather than assuming theoretical risk. Defensive priorities: First, verify whether the affected upload endpoint is protected by anti-CSRF mechanisms. Second, check your Adobe Commerce deployment's file storage configuration — uploads must be stored outside the web root or in a path that explicitly prevents PHP/execution, regardless of file extension. Third, audit any third-party extensions that implement file uploads, as they inherit the same architectural problem. The platform architecture appears to conflate content storage with content execution, placing an unreasonable validation burden on developers — your goal is to ensure your specific implementation doesn't inherit that failure.

Reviewed through automated stages and approved by a human before publication.