Executive brief
Amasty Order Attributes is a popular extension for Magento 2 and Adobe Commerce stores that allows merchants to collect additional information during checkout. A critical security flaw allows anyone on the internet to upload malicious files to the web server without needing to log in or even have an active shopping cart. This could allow attackers to take full control of the online store, steal customer payment data, or host malware on the company's trusted domain.
Technical details
An unauthenticated arbitrary file upload vulnerability exists in the Amasty Order Attributes extension for Magento 2 (versions prior to 4.0.0). The vulnerability stems from a lack of authentication, session validation, or cart context checks on the file upload endpoint. An attacker can submit files of any type or name, including PHP scripts, to the store's media directory. If the server configuration allows PHP execution within the media directory, this leads to Remote Code Execution (RCE). Additionally, the flaw supports path traversal, potentially allowing files to be written outside the intended directory, and can be used for stored Cross-Site Scripting (XSS) via HTML or SVG uploads. Amasty addressed this in version 4.0.0 by implementing an extension allow-list and requiring a mandatory attribute_code parameter.
Affected products
- Amasty Order Attributes for Magento 2 < 4.0.0
Timeline
- 2026-06-12: patched: Amasty released version 4.0.0 to address the vulnerability.
- 2026-06-12: disclosed: Sansec published the initial research and advisory.
- 2026-06-12: advisory: CVE-2026-53787 published.