Magento Open Source and Adobe Commerce StyleSmuggler Remote Code Execution Webapp Exploit

This module exploits CVE-2026-75650, a critical unauthenticated template injection vulnerability in Magento Open Source and Adobe Commerce known as StyleSmuggler. Improper neutralization of template-engine elements allows a remote attacker to execute arbitrary code through the Magento storefront. The exploit performs the following actions: Sends a crafted request to the Payflow transparent-response endpoint to create a Magento error report containing a PHP command runner. Extracts the generated report identifier and resolves its location. A configured REPORT DIRECTORY override is tried first; otherwise, the module tests paths relative to the Magento front controller. Creates an unauthenticated guest cart and assigns a guest email address. Stores the StyleSmuggler Preview block payload in the guest billing address. Triggers the failed-payment GraphQL path with a crafted styles object graph that includes the poisoned report. Confirms operating-system command execution with a harmless marker and deploys the selected Impact agent. By default, the module commits an interactive OSCI agent that replays the complete StyleSmuggler chain for every command and returns standard output. A Linux x86-64 Network Agent can be deployed as an alternative through the standard download-and-execute flow, which tries curl, wget, and BusyBox wget in that order. Commands and agents run with the privileges of the Magento web-server process. No Magento credentials are required. The target webpage supplies the HTTP or HTTPS scheme, host, port, and Magento installation path. Adobe lists Adobe Commerce 2.4.4-2026-aug through 2.4.9-2026-aug and earlier releases in those version lines, Adobe Commerce B2B 1.3.3-2026-aug through 1.5.3-2026-aug and earlier releases in those version lines, and Magento Open Source 2.4.6-2026-aug through 2.4.9-2026-aug and earlier releases in those version lines as affected.