## https://sploitus.com/exploit?id=14453898-58EA-59FC-B0F2-1A4092A77789
# CVE-2026-53787 - Amasty Order Attributes Unauthenticated File Upload
## Description
CVE-2026-53787 is a critical unauthenticated arbitrary file upload vulnerability in the Amasty Order Attributes extension for Magento 2 versions prior to 4.0.0 . The vulnerability allows attackers to upload files of any type or name to the store's media directory without requiring authentication, session validation, or cart context .
## Impact
The attack requires no credentials and can be executed over the network . The vulnerability has a CVSS score of 9.8 (Critical) . A successful exploit can lead to:
- Remote Code Execution (RCE) if PHP execution is permitted in the media directory, giving attackers full server control
- Malware hosting using the trusted domain
- Stored Cross-Site Scripting (XSS) via HTML or SVG uploads
- Path traversal attacks to write files outside the intended upload directory
## Affected Endpoints
The vulnerability targets the following REST endpoints :
```
POST /rest/V1/amasty_orderattr/uploadFile
POST /rest/all/V1/amasty_orderattr/uploadFile
POST /rest/default/V1/amasty_orderattr/uploadFile
```
## Exploitation Activity
Mass exploitation began hours after the patch was released on June 12, 2026 . By June 15, over 12,000 exploitation attempts were detected against 25% of all Magento stores .
## Remediation
- Upgrade Amasty Order Attributes to version 4.0.0 or later
- Configure the web server to disable PHP execution in the media directory
- Implement strict file upload validation and extension allow-lists