{"schema":"vulnpedia.research/1","cve":"CVE-2026-48356","references":[{"url":"https://helpx.adobe.com/security/products/magento/apsb26-73.html","tags":["vendor-advisory","Vendor Advisory"],"source":"mitre","sourceId":"adobe","modified":"2026-08-27T22:39:18.114Z","origins":[{"source":"mitre","sourceId":"adobe","modified":"2026-08-27T22:39:18.114Z","url":"https://helpx.adobe.com/security/products/magento/apsb26-73.html"},{"source":"nvd","sourceId":"CVE-2026-48356","modified":"2026-08-28T00:17:52.187","url":"https://helpx.adobe.com/security/products/magento/apsb26-73.html"}]},{"source":"euvd","sourceId":"EUVD-2026-44420","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-44420","tags":["ADVISORY"],"origins":[{"source":"euvd","sourceId":"EUVD-2026-44420","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-44420"}]},{"url":"https://vulncheck.com/kev","tags":["ADVISORY"],"source":"vulncheck-kev","sourceId":"CVE-2026-48356","modified":"2026-10-24T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-48356","modified":"2026-10-24T00:00:00Z","url":"https://vulncheck.com/kev"}]},{"url":"https://sansec.io/research/magento-cms-block-loader-deepveindrilling","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-48356","modified":"2026-10-24T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-48356","modified":"2026-10-24T00:00:00Z","url":"https://sansec.io/research/magento-cms-block-loader-deepveindrilling"}]},{"url":"https://vulncheck.com/xdb/252b3f56152d","tags":["XDB catalogue"],"source":"vulncheck-kev","sourceId":"252b3f56152d","modified":"2026-10-24T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"252b3f56152d","modified":"2026-10-24T00:00:00Z","url":"https://vulncheck.com/xdb/252b3f56152d"}]},{"url":"https://github.com/abraxas/CVE-2026-48356","tags":["XDB repository"],"source":"vulncheck-kev","sourceId":"252b3f56152d","modified":"2026-10-24T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"252b3f56152d","modified":"2026-10-24T00:00:00Z","url":"https://github.com/abraxas/CVE-2026-48356"}]}],"packages":[],"pocCandidates":[{"url":"https://github.com/abraxas/CVE-2026-48356","source":"poc-in-github","sourceId":"CVE-2026-48356","description":"CVE-2026-48356 - Magento Open Source - Critical 9.3 - Unauthenticated POST /rest/default/V1/guest-carts/{cartId}/items - Unauthenticated Unrestricted File Upload (PolyShell)","modified":"2026-10-07T01:06:51Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-48356","url":"https://github.com/abraxas/CVE-2026-48356"},{"source":"poc-in-github","sourceId":"CVE-2026-48356","modified":"2026-10-07T01:06:51Z","url":"https://github.com/abraxas/CVE-2026-48356"}],"tags":[]}],"cataloguedPoc":[{"source":"vulncheck-kev","kind":"vulncheck-xdb","verification":"catalogued","sourceId":"252b3f56152d","url":"https://vulncheck.com/xdb/252b3f56152d","cve":"CVE-2026-48356","dateAdded":"2026-09-28T09:31:34Z","modified":"2026-10-24T00:00:00Z","exploitType":"initial-access","repositoryUrl":"https://github.com/abraxas/CVE-2026-48356","observations":[{"dateAdded":"2026-09-28T09:31:34Z","exploitType":"initial-access"}],"tags":[],"origins":[{"source":"vulncheck-kev","sourceId":"252b3f56152d","modified":"2026-10-24T00:00:00Z","url":"https://vulncheck.com/xdb/252b3f56152d"}]}],"vendorStatements":[],"exploitationSources":[{"source":"vulncheck-kev","sourceId":"CVE-2026-48356","catalog":"VulnCheck KEV","kind":"catalogue","url":"https://vulncheck.com/kev","dateAdded":"2026-10-24T00:00:00Z","modified":"2026-10-24T00:00:00Z","requiredAction":"Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown","reportedByVulncheckCanaries":false,"vendorProject":"Adobe","product":"commerce","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-48356","modified":"2026-10-24T00:00:00Z","url":"https://vulncheck.com/kev"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-48356","catalog":"VulnCheck KEV","kind":"report","url":"https://sansec.io/research/magento-cms-block-loader-deepveindrilling","dateAdded":"2026-10-24T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-48356","url":"https://sansec.io/research/magento-cms-block-loader-deepveindrilling"}]}]}