{"id":"CVE-2026-48356","revision":null,"records":[{"revision":"56c3162fd07847699a61cf528727d162","observedAt":"2026-10-28T04:51:21.236+00:00","statement":{"source":"cve-program","id":"CVE-2026-48356","aliases":[],"title":"Adobe Commerce | Unrestricted Upload of File with Dangerous Type (CWE-434)","description":"Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.","state":0,"publishedAt":"2026-07-14T19:44:17.036+00:00","modifiedAt":"2026-10-28T03:55:44.631+00:00","affected":[{"ecosystem":"Vendor product","name":"Adobe Commerce","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"defaultStatus\": \"unaffected\",\n                    \"product\": \"Adobe Commerce\",\n                    \"vendor\": \"Adobe\",\n                    \"versions\": [\n                        {\n                            \"lessThanOrEqual\": \"2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, 2.4.4-p18\",\n                            \"status\": \"affected\",\n                            \"version\": \"0\",\n                            \"versionType\": \"custom\"\n                        },\n                        {\n                            \"status\": \"unaffected\",\n                            \"version\": \"2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul, 2.4.5-2026-jul, 2.4.4-2026-jul\",\n                            \"versionType\": \"custom\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Adobe Commerce B2B","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"defaultStatus\": \"unaffected\",\n                    \"product\": \"Adobe Commerce B2B\",\n                    \"vendor\": \"Adobe\",\n                    \"versions\": [\n                        {\n                            \"lessThanOrEqual\": \"1.5.3, 1.5.2-p5, 1.4.2-p10, 1.3.4-p17, 1.3.3-p18\",\n                            \"status\": \"affected\",\n                            \"version\": \"0\",\n                            \"versionType\": \"custom\"\n                        },\n                        {\n                            \"status\": \"unaffected\",\n                            \"version\": \"1.5.3-2026-jul, 1.5.2-2026-jul, 1.4.2-2026-jul, 1.3.4-2026-jul, 1.3.3-2026-jul\",\n                            \"versionType\": \"custom\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Magento Open Source","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"defaultStatus\": \"unaffected\",\n                    \"product\": \"Magento Open Source\",\n                    \"vendor\": \"Adobe\",\n                    \"versions\": [\n                        {\n                            \"lessThanOrEqual\": \"2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15\",\n                            \"status\": \"affected\",\n                            \"version\": \"0\",\n                            \"versionType\": \"custom\"\n                        },\n                        {\n                            \"status\": \"unaffected\",\n                            \"version\": \"2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul\",\n                            \"versionType\": \"custom\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Adobe Commerce Events","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"defaultStatus\": \"unaffected\",\n                    \"product\": \"Adobe Commerce Events\",\n                    \"vendor\": \"Adobe\",\n                    \"versions\": [\n                        {\n                            \"lessThanOrEqual\": \"1.20.0\",\n                            \"status\": \"affected\",\n                            \"version\": \"0\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"status\": \"unaffected\",\n                            \"version\": \"1.21.0\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","score":9.3,"severity":"CRITICAL"}],"references":["https://helpx.adobe.com/security/products/magento/apsb26-73.html"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-48356","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-48356","identifiers":["CVE-2026-48356"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-10-31T15:05:03.4732281+00:00","complete":true,"records":1766,"lastAttemptAt":"2026-10-31T15:05:03.4732281+00:00","lastSuccessAt":"2026-10-31T15:05:03.6216092+00:00","error":null,"lastVerifiedAt":"2026-10-31T15:05:03.621611+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-9266d7b009bf9c4a0ccdcb5cbdea7f905cb3c4d92fd3b41581ece16b2cfdc4e7-8544f3bcef74cbc883873ef332214908d149a018eb144c089fad2f199e13911a","complete":true,"records":417574,"lastAttemptAt":"2026-10-31T15:05:02.7506676+00:00","lastSuccessAt":"2026-10-31T15:05:02.7188611+00:00","error":null,"lastVerifiedAt":"2026-10-31T15:05:02.7506676+00:00","snapshotPublishedAt":"2026-10-31T14:20:54+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-1ea90a365f5b43ef9a5b92be53fe0867","complete":true,"records":13565,"lastAttemptAt":"2026-10-31T15:05:29.8505291+00:00","lastSuccessAt":"2026-10-31T11:34:32.033+00:00","error":null,"lastVerifiedAt":"2026-10-31T11:34:32.033+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13637,"expectedIdentifiers":13637,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-10-31T15:05:03.4732281+00:00","complete":true,"records":1094,"lastAttemptAt":"2026-10-31T15:05:03.4732281+00:00","lastSuccessAt":"2026-10-31T15:05:03.6228797+00:00","error":null,"lastVerifiedAt":"2026-10-31T15:05:03.6228802+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-0b4ce912e9594c1898691b107f7c0b95","complete":true,"records":13577,"lastAttemptAt":"2026-10-31T15:05:29.1766677+00:00","lastSuccessAt":"2026-10-31T15:05:29.172+00:00","error":null,"lastVerifiedAt":"2026-10-31T15:05:29.172+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13637,"expectedIdentifiers":13637,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-21dcd6662970dfea02e4ea60ee637115e8d92664947484d2b9276b3f6568a84f","complete":true,"records":9815,"lastAttemptAt":"2026-10-31T15:05:03.4133224+00:00","lastSuccessAt":"2026-10-30T23:47:34.1817587+00:00","error":null,"lastVerifiedAt":"2026-10-31T15:05:03.4133224+00:00","snapshotPublishedAt":"2026-10-30T23:33:17+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-2de9ccc5290f060c7aa63f89c25dd76f655a64ba1aba7c05c97fa3bee4f09899","complete":true,"records":1967,"lastAttemptAt":"2026-10-31T15:05:02.9199792+00:00","lastSuccessAt":"2026-10-28T20:55:34.2982937+00:00","error":null,"lastVerifiedAt":"2026-10-31T15:05:02.9199792+00:00","snapshotPublishedAt":"2026-10-28T20:03:08+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-f95f76cd406ae5bae3de632ad37fd2d5160b44f5e6b51748ac6f8f0c0c88e72b","complete":true,"records":3028,"lastAttemptAt":"2026-10-31T15:05:03.4292973+00:00","lastSuccessAt":"2026-10-30T23:47:38.4914494+00:00","error":null,"lastVerifiedAt":"2026-10-31T15:05:03.4292973+00:00","snapshotPublishedAt":"2026-10-30T23:18:12+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-d37f475fd4943f3910741120036649d396d0a133edf936fc0112d88abf9bb041","complete":true,"records":230993,"lastAttemptAt":"2026-10-31T15:05:03.2975216+00:00","lastSuccessAt":"2026-10-31T12:35:41.6420764+00:00","error":null,"lastVerifiedAt":"2026-10-31T15:05:03.2975216+00:00","snapshotPublishedAt":"2026-10-31T12:33:12+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}