PolyShell Vulnerability Exposes Adobe Commerce and Magento to Remote Code Execution

Sansec reports "PolyShell," an unrestricted file upload vulnerability (CVE-2025-20720) in Magento and Adobe Commerce that allows unauthenticated attackers to achieve remote code execution via the REST API.

**If you are using Adobe Commerce and Magento Open Source, restrict web server access to the pub/media/custom_options/ directory to prevent the execution of uploaded malicious scripts. Since a production patch is currently not afailable, deploy a web application firewall to block exploit attempts in real-time.**
#cybersecurity #infosec #advisory #databreach
https://beyondmachines.net/event_details/polyshell-vulnerability-exposes-adobe-commerce-and-magento-to-remote-code-execution-9-b-r-8-z/gD2P6Ple2L