A critical, unauthenticated vulnerability is letting anyone plant hidden backdoors on Magento stores through the checkout page — no password, no admin access, no warning. If you haven’t upgraded to Magento 2.4.9, this is about you.
We found this the hard way — while doing a routine security check on a client’s store, our host’s malware scanner flagged thousands of disguised files quietly sitting in the media folder. Here’s what they were, how they got there, and the free fix we built because Adobe hasn’t backported one.
What Is PolyShell?
PolyShell is the nickname for APSB25-94, an unrestricted file upload vulnerability in Magento’s own checkout code. It affects every version of Magento Open Source and Adobe Commerce up to and including 2.4.9-alpha2 — which, in practice, means almost every live Magento store that hasn’t upgraded to 2.4.9 yet.
The bug lives in the same API endpoint used for a completely normal feature: uploading a file as part of a product’s “Custom Option” during checkout, or as an attachment on a customer address. Attackers don’t need an account, a password, or admin access — the endpoint is open to anyone, guest carts included.
How the Attack Actually Works
This is the part that makes it nasty: Magento checks that an uploaded file looks like a real image (it reads the image header), but it never checks the file’s actual extension. So an attacker uploads a genuinely valid, tiny image with PHP code appended to it, names the file something.php, and Magento saves it exactly as given — no questions asked.
The result sits quietly inside pub/media/custom_options/quote/ or pub/media/customer_address/, looking like harmless upload debris, until someone requests it directly by URL and it runs as PHP.
Is Your Store Affected?
If you’re running Magento 2.4.8 or earlier — yes, the vulnerability is present. Whether it’s been exploited is a separate question. Check these two directories for files with any of these extensions:
.php,.phtml,.phar.pht,.phtm.php3through.php8
If you find any that you didn’t put there, don’t panic and don’t just delete them yet — check your server’s own PHP-execution rules for that directory first (a properly configured .htaccess blocking PHP execution in pub/media can mean the files were written but never actually ran), and back up anything unusual before you clean it out.
The Fix Nobody’s Shipping for Older Versions
Adobe’s own patch for this only exists in Magento 2.4.9. If you’re not ready for that upgrade — and a full version bump is a real project, not a quick patch — you’re stuck waiting, unless you close the gap yourself.
So we did. We wrote a small, free, fully open module that plugs directly into the same validation Magento already runs and adds the one check that’s missing: a real image-extension allowlist. No reflection tricks, no black-box “security suite,” just one plugin you can read start to finish in five minutes.
Grab it here: github.com/open-ecommerce/magento-polyshell-blocker
composer require open-ecommerce/magento-polyshell-blocker
bin/magento module:enable OpenEcommerce_UploadExtensionGuard
bin/magento setup:upgrade
bin/magento setup:di:compile
bin/magento cache:flushDon’t skip setup:di:compile — if your store runs in production mode (most live stores do), Magento won’t actually load the new plugin without it, and you’ll get no error telling you that. The README has a one-line command to verify it’s really active before you trust it.
It’s tested (22 passing unit tests, not just a demo), it’s small enough to audit yourself in five minutes, and it’s free.
Don’t Wait to Find Out the Hard Way
If you’re running a Magento store on 2.4.8 or earlier, this isn’t a “someday” fix. The vulnerability is already public, already documented, and already being scanned for at scale. Patch the gap, check your media folders, and if you want a second pair of eyes on it, get in touch — this is exactly the kind of thing we deal with daily.
Open Ecommerce is a Magento development co-operative. We build, maintain, and secure Magento stores for a living — this fix came out of real incident-response work, not a lab exercise.
