PolyShell Vulnerability Exposes Adobe Commerce and Magento to Remote Code Execution
Take action: If you are using Adobe Commerce and Magento Open Source, restrict web server access to the pub/media/custom_options/ directory to prevent the execution of uploaded malicious scripts. Since a production patch is currently not afailable, deploy a web application firewall to block exploit attempts in real-time.
Learn More
Researchers report a security risk from a vulnerability named "PolyShell," in Adobe Commerce and Magento Open Source which allows unauthenticated attackers to upload executable files to web servers.
The flaw is tracked as CVE-2025-20720 (CVSS score 9.8), an unrestricted file upload vulnerability in the Magento REST API that allows unauthenticated attackers to write malicious files to the server. By submitting a base64-encoded "polyglot" file through the cart item's file_info object, attackers can bypass security filters to place executable code in the pub/media/custom_options/quote/ directory. This flaw can lead to full remote code execution or account takeover via stored cross-site scripting.
When a user adds an item to a cart, the API processes an embedded file_info object containing base64-encoded data, a MIME type, and a filename. Unlike the GraphQL path, which uses a different and secure code sequence, the REST API writes these files directly to a publicly accessible server directory. This allows attackers to place "webshells" on the server that can be triggered later to run system commands.
The flaw affects all versions up to 2.4.9-alpha2. Adobe addressed the issue in a pre-release version APSB25-94, but no standalone patch is currently available for production environments,
Security researchers at Sansec warn that even if a server currently blocks the execution of scripts in the upload directory, the malicious files remain on the disk. These files can become active threats during future server migrations, configuration changes, or web server swaps. The risk is increased since many hosting providers use custom configurations that do not follow Adobe's recommended security hardening, often leaving the /media/custom_options/ folder exposed to direct web access.
Administrators should restrict all web access to the pub/media/custom_options/ directory using Nginx or Apache configuration rules. Organizations are also encouraged to use specialized web application firewalls to block incoming "PolyShell" exploit patterns in real-time.
