Magento Open Source and Adobe Commerce can accept a dangerous filename through guest-cart custom option file metadata while validating the supplied bytes as an image. A GIF/PHP polyglot can therefore be persisted with a PHP extension under the custom option media area. The module discovers the active store code through GraphQL. When the catalog exposes exactly one in-stock product, it resolves the SKU automatically; catalogs with multiple candidates require the optional advanced SKU override. The vulnerable endpoint accepts the file metadata with an arbitrary numeric option identifier, which the module supplies internally. Upload acceptance is intermediate evidence only. The module proves PHP interpretation and operating-system command execution before committing an OSCI agent. Each OSCI command uses a new random, token-guarded GIF/PHP polyglot which deletes itself before running the requested command. Optional native Network-agent delivery uses curl and verifies the exit status of every installer command. The Network agent option is disabled by default. Execution depends on a web-server route that sends uploaded PHP files to PHP-FPM. A blocked media route is an execution-route precondition failure and does not prove that the unrestricted upload is patched. The OSCI agent runs commands with the privileges of the PHP service account and is not expected to be a superuser.
CVE Link
Exploit Platform
Exploit Type
Product Name