Adobe Commerce and Magento Unrestricted File Upload to Web Shell (CVE-2026-48356)

// df00tech DF00-e157934fd5 · https://df00tech.com/detections/CVE-2026-48356 · licence: https://df00tech.com/detections/licence
let lookback = 24h;
CommonSecurityLog
| where TimeGenerated >= ago(lookback)
| where isnotempty(RequestURL)
| extend Path = tolower(tostring(parse_url(RequestURL).Path))
| where Path matches regex @"^/(pub/)?media/.*\.(php[0-9]?|phtml|phar)$"
| summarize Hits = count(), Paths = make_set(Path, 10), Methods = make_set(RequestMethod), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationHostName
| order by Hits desc

``` df00tech DF00-e157934fd5 · https://df00tech.com/detections/CVE-2026-48356 · licence: https://df00tech.com/detections/licence ```
index=web (sourcetype=access_combined OR sourcetype=nginx:plus:access OR sourcetype=ms:iis:auto) earliest=-24h
| where match(uri_path, "(?i)^/(pub/)?media/.*\.(php[0-9]?|phtml|phar)$")
| stats count AS hits values(uri_path) AS paths values(status) AS statuses earliest(_time) AS firstSeen latest(_time) AS lastSeen BY src, dest
| convert ctime(firstSeen) ctime(lastSeen)
| sort - hits

// df00tech DF00-e157934fd5 · https://df00tech.com/detections/CVE-2026-48356 · licence: https://df00tech.com/detections/licence
any where event.category == "web" and url.path regex~ "/(pub/)?media/.*\\.(php[0-9]?|phtml|phar)"

-- df00tech DF00-e157934fd5 · https://df00tech.com/detections/CVE-2026-48356 · licence: https://df00tech.com/detections/licence
SELECT sourceip, destinationip, "URL", QIDNAME(qid) AS event_name, DATEFORMAT(starttime,'yyyy-MM-dd HH:mm:ss') AS event_time FROM events WHERE (LOGSOURCETYPENAME(devicetype) ILIKE '%apache%' OR LOGSOURCETYPENAME(devicetype) ILIKE '%iis%' OR LOGSOURCETYPENAME(devicetype) ILIKE '%nginx%') AND ("URL" ILIKE '%/media/%.php%' OR "URL" ILIKE '%/media/%.phtml%' OR "URL" ILIKE '%/media/%.phar%') ORDER BY starttime DESC LAST 24 HOURS

// df00tech DF00-e157934fd5 · https://df00tech.com/detections/CVE-2026-48356 · licence: https://df00tech.com/detections/licence
_sourceCategory=*nginx* OR _sourceCategory=*apache* OR _sourceCategory=*iis*
| parse regex "(?<method>GET|POST|PUT) (?<uri>/[^ ?]*)" nodrop
| where toLowerCase(uri) matches /^\/(pub\/)?media\/.*\.(php[0-9]?|phtml|phar)$/
| count by _sourceHost, uri, method
| sort by _count desc

// df00tech DF00-e157934fd5 · https://df00tech.com/detections/CVE-2026-48356 · licence: https://df00tech.com/detections/licence
rule magento_media_script_request_cve_2026_48356 {
  meta:
    author = "Argus"
    description = "Request for a script file under Magento media (CVE-2026-48356)"
    severity = "HIGH"
  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    re.regex($e.target.url, `(?i)/(pub/)?media/[^?]*\.(php[0-9]?|phtml|phar)(\?|$)`)
    $src = $e.principal.ip
  match:
    $src over 1h
  condition:
    $e
}

// df00tech DF00-e157934fd5 · https://df00tech.com/detections/CVE-2026-48356 · licence: https://df00tech.com/detections/licence
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| ParentBaseFileName=/^(php-fpm[0-9.]*|php-cgi|httpd|apache2|nginx)$/i
| ImageFileName=/(\\|\/)(sh|bash|dash|curl|wget|nc)$/i
| table([@timestamp, ComputerName, ParentBaseFileName, ImageFileName, CommandLine])