CVE-2026-53787

Name of the Vulnerable Software and Affected Versions Amasty Order Attributes for Magento 2 versions prior to 4.0.0

Description An unauthenticated arbitrary file upload issue allows attackers to write files of any type or name to the store's media directory. This occurs because the upload endpoint lacks authentication, session validation, and cart context. This can lead to remote code execution if the media directory permits PHP execution. Additionally, it enables malware hosting, stored cross-site scripting (XSS)—where malicious scripts are permanently stored on the server—via HTML or SVG uploads, and path traversal to write files outside the intended directory.

Recommendations Update to version 4.0.0 or later.