Brief Summary: CVE-2026-53787 Unauthenticated File Upload in Amasty Order Attributes for Magento 2

Introduction

An unauthenticated file upload endpoint in one of Magento's most popular third-party checkout extensions just handed attackers a zero-friction path to remote code execution on potentially thousands of e-commerce stores. CVE-2026-53787, disclosed on June 12, 2026, affects Amasty Order Attributes for Magento 2 and carries a CVSS 3.1 score of 9.8. The score reflects that exploitation requires no credentials, no session, and no user interaction whatsoever.

Amasty is a major Magento extension vendor. It has been operating since 2009, maintains a portfolio of over 270 modules, and markets itself as the "#1 Magento Solutions Provider." The Order Attributes extension lets merchants add custom fields to checkout steps, including a "Single File Upload" attribute type that lets customers attach files to orders. Given Amasty's market presence and the extension's popularity, the affected install base across the Magento ecosystem is substantial.

Technical Information

Root Cause: CWE-434 Unrestricted Upload of File with Dangerous Type

The vulnerability is in the upload endpoint for the extension's "Single File Upload" attribute type. That endpoint has no security controls at any of three layers:

No authentication required. Anyone can reach the endpoint without logging in, without a valid session, and without any cart context. An attacker can send a POST request straight to it as ordinary storefront traffic. The CVSS vector records this in its PR:N (No Privileges Required) and UI:N (No User Interaction) components.

No file type validation. The endpoint accepts any file type under any name. It has no extension allow list, no content type verification, and no MIME type check, so it accepts executable files such as .php, .phtml, or .phar without restriction.

No filename sanitization (path traversal). The endpoint does not strip directory traversal sequences from the filename parameter. How far an attacker can traverse depends on the version:

CVSS Scoring

With a Network attack vector, Low attack complexity, and No privileges required, any remote attacker anywhere on the internet can exploit this flaw with minimal effort.

Attack Flow

The main exploitation scenario is remote code execution through an uploaded PHP file. It runs in four steps:

1. Reconnaissance. The attacker finds a Magento store running Amasty Order Attributes, either by probing for the extension's upload endpoint or by spotting the extension in storefront markup.

2. File upload. The attacker sends a POST request containing a PHP webshell to the upload endpoint. No authentication token, session cookie, or cart identifier is needed. The file is written to the pub/media/amasty_checkout/ directory (or, via path traversal, to other locations).

3. Code execution. The attacker requests the uploaded file at its URL (e.g., https://target.store/media/amasty_checkout/shell.php). On servers where the pub/media directory permits PHP execution, the webshell runs with the web server's privileges.

4. Post-exploitation. With arbitrary command execution, the attacker can exfiltrate customer data, install payment card skimmers in checkout templates, access the database directly, or establish persistent backdoors.

Alternative Exploitation Outcomes

Remote code execution has the highest impact, but it only works when PHP execution is enabled in the media directory. The other exploitation paths do not need that:

How Version 4.0.0 Addresses the Vulnerability

Amasty released version 4.0.0 on June 12, 2026, with three specific security controls:

1. Mandatory attribute_code parameter: The upload endpoint rejects requests without a valid attribute_code, which blocks blind file uploads to arbitrary attribute contexts.
2. Extension allow list: Only permitted file extensions get through. Executable types like .php, .phtml, and .phar are rejected.
3. Pre-commit validation: Files are checked before they are written to disk rather than after, which eliminates race conditions or partial writes.

Connection to the PolyShell Campaign

Magento threat actors have already exploited this kind of flaw at scale. In March 2026, Sansec disclosed PolyShell, an unrestricted file upload flaw in the Magento REST API core that let attackers upload executable files disguised as images using polyglot techniques. Sansec observed PolyShell attacks targeting 79.5% of all Magento stores, and automated mass scanning began within two days of disclosure. Attackers deployed accesson.php backdoors and obfuscated two-stage JavaScript persistence loaders.

CVE-2026-53787 exposes a nearly identical attack surface, an unauthenticated file upload into the media directory. The automated infrastructure built for PolyShell can likely be adapted to target this vulnerability with minimal modification.

Affected Systems and Versions

All versions of Amasty Order Attributes for Magento 2 prior to version 4.0.0 are affected:

• All versions up to and including 3.16.0: Vulnerable to unauthenticated arbitrary file upload and to path traversal outside the amasty_checkout subfolder.
• Versions prior to 2.4.2: Also vulnerable to full path traversal escape from the pub/media directory, which allows writes to arbitrary server locations.
• Fixed version: 4.0.0, released June 12, 2026.

Any Magento 2 store running an affected version of the extension is exploitable. The RCE variant also needs a web server configuration that permits PHP execution within the pub/media/ directory or its subdirectories, which is the case in many default or misconfigured Magento deployments.

Vendor Security History

Amasty has at least one prior publicly disclosed vulnerability:

The earlier CVE-2022-36432 was a medium-severity XSS flaw with an EPSS score of 0.27%. CVE-2026-53787 is a significant escalation in both severity and attack surface. On the positive side, Amasty released the fix on the same day as the Sansec disclosure, which indicates coordinated vulnerability handling. The company also publishes a Magento Security Patches Calendar on its blog that covers critical vulnerabilities such as SessionReaper (CVE-2025-54236), which suggests ongoing engagement with Magento security beyond its own products.

References

• CVE Record: CVE-2026-53787
• Sansec Research: Unauthenticated file upload in Amasty Order Attributes
• VulnCheck Advisory: Amasty Order Attributes for Magento 2 Unauthenticated Arbitrary File Upload
• Amasty Order Attributes for Magento 2 Product Page
• GitHub Advisory: GHSA-mgg8-gq8g-gq88
• Cyber Defence Vulnerability Database: CVE-2026-53787
• VulDB: Amasty Order Attributes for Magento 2 Upload Vulnerability
• Sansec Research: PolyShell Unrestricted File Upload in Magento
• CWE-434: Unrestricted Upload of File with Dangerous Type
• CVE-2022-36432: Amasty Blog Pro XSS
• Malwarebytes: Magecart Skimming Hits Major Payment Networks (January 2026)
• Sansec Research: SVG Onload Magecart Skimmer on 99 Stores
• CISA Known Exploited Vulnerabilities Catalog