CVE-2026-53787: Amasty Order Attributes for Magento 2 < 4.0.0 Unauthenticated Arbitrary File Upload

Synopsis

This is an unauthenticated arbitrary file upload vulnerability in the Amasty Order Attributes extension for Magento 2, affecting all versions before 4.0.0. The upload endpoint is reachable over the network and requires no authentication, session token, or shopping cart context to exploit. Successful exploitation allows an attacker to write arbitrary files, including PHP scripts, to the server, enabling remote code execution, malware hosting, stored cross-site scripting via HTML or SVG payloads, and path traversal writes outside the intended media directory. A patched-image rebuild at version 4.0.0 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable upload endpoint is exposed over the network, so an attacker must be able to reach the Magento 2 store via HTTP or HTTPS.

• AuthenticationNot required

  No account, session token, or cart context is required; the endpoint accepts file submissions from any unauthenticated request.

• Victim interactionNot required

  The attack is fully server-side; no user action or social engineering is needed to complete the exploit.

• Attack complexityDetail

  Exploitation is reliable and condition-free, with no race conditions or special environmental factors required to upload a file successfully.

Blast Radius

• Attacker writes a PHP webshell to the media directory and executes arbitrary OS commands on the underlying server where PHP execution is permitted in that directory.
• Attacker uploads HTML or SVG files containing malicious scripts, which execute in the browsers of store visitors or administrators who load the uploaded content.
• Attacker uses path traversal in the filename to write files outside the intended media directory, potentially overwriting application files or configuration.
• Attacker hosts malware or phishing pages on the compromised store's domain by writing arbitrary content through the upload endpoint.