Read the docs
TI-2026-38783 Aliases CVE-2026-53787GHSA-mgg8-gq8g-gq88

Amasty Order Attributes for Magento 2 < 4.0.0 Unauthenticated Arbitrary File Upload

Priority MEDIUM 57CWE-434Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-434.

Summary

Amasty Order Attributes for Magento 2 before version 4.0.0 contains an unauthenticated arbitrary file upload vulnerability that allows unauthenticated attackers to write arbitrary files to the store's media directory by submitting files of any type or name to the upload endpoint without authentication, session validation, or cart context. Attackers can upload PHP files to achieve remote code execution on servers where the media directory permits PHP execution, or alternatively enable malware hosting, stored cross-site scripting via HTML or SVG uploads, and path traversal to write files outside the intended upload directory.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.05638 93rd percentileScored 2026-11-07
Fix Fixed Order Attributes for Magento 2 (Amasty): 4.0.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AmastyOrder Attributes for Magento 2before 4.0.04.0.0Patch availableCNA
  • Order Attributes for Magento 2 VendorAmasty Affected before 4.0.0 Fixed in 4.0.0 Patch available CNA

Remediation

  • Fix · CNA Order Attributes for Magento 2 (Amasty) Fixed in 4.0.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-53787
  2. 2026-10-03 Alias added: GHSA-mgg8-gq8g-gq88

References

Other 2

  • TI-2022-16759 The Preview functionality in the Amasty Blog Pro 2.10.3 plugin for Magento 2 uses eval… CVSS 3.1MEDIUM 5.4
  • TI-2022-16760 The blog-post creation functionality in the Amasty Blog Pro 2.10.3 plugin for Magento 2… CVSS 3.1MEDIUM 6.1
  • TI-2022-16045 Stored Cross-site Scripting (XSS) exists in the Amasty Blog Pro 2.10.3 and 2.10.4 plugin… CVSS 3.1MEDIUM 5.4
  • TI-2022-16044 Amasty Blog 2.10.3 is vulnerable to Cross Site Scripting (XSS) via leave comment functionality. CVSS 3.1MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences