Arbitrary file upload in Adobe products - CVE-2026-48356

Vulnerability identifier: #VU137585

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-48356

CWE-ID: CWE-434

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to escalate privileges.

The vulnerability exists due to unrestricted upload of file with dangerous type in file upload functionality when handling uploaded files. A remote attacker can upload a dangerous file to escalate privileges.

User interaction is required for exploitation.

Adobe Commerce B2B
Magento Open Source
Adobe Commerce (formerly Magento Commerce)

Install security update from vendor's website.

Adobe Commerce B2B - addressed in versions 1.3.3-2026-jul, 1.3.4-2026-jul, 1.4.2-2026-jul, 1.5.2-2026-jul, 1.5.3-2026-jul
Magento Open Source - addressed in versions 2.4.6-2026-jul, 2.4.7-2026-jul, 2.4.8-2026-jul, 2.4.9-2026-jul
Adobe Commerce (formerly Magento Commerce) - addressed in versions 2.4.4-2026-jul, 2.4.5-2026-jul, 2.4.6-2026-jul, 2.4.7-2026-jul, 2.4.8-2026-jul, 2.4.9-2026-jul

• https://helpx.adobe.com/security/products/magento/apsb26-73.html
• https://helpx.adobe.com/security.html

• Multiple vulnerabilities in Adobe Commerce and Magento Open Source