Shared on Mage Dispatch · 11 Nov 2025
This is a Magento 2 extension that prevents file uploads to /customer/address_file/upload endpoint which is used in combination with an flaw in Magento's logic to upload code and then execute it for CVE-2025-54236.
Adds an admin-area file browser and text editor with clickable breadcrumbs, ACL-controlled view/edit access, and a detailed activity log. Enforces strict security with path validation, a sensitive-file denylist, and allowlisted text types only—no upload, delete, or rename actions.
A priority-ordered roadmap for using AI at speed without chaos: automated deployments, ephemeral environments, E2E and unit tests, static analysis, and security tooling. Explains what “good” looks like, what breaks without each layer, and where to start.
Adds SAML-based single sign-on for backend users, compatible with IdPs like Auth0, OneLogin, and Amazon SSO. Install via composer and configure under Stores > Configuration > Advanced > Admin > Single Sign-on.
Mage Dispatch is a community-run archive and bi-weekly newsletter for the Magento, Adobe Commerce and Mage-OS ecosystem. Modules, articles, security advisories and tools, hand-picked by developers and shared so good work does not disappear into the void.
Browse the latest links → Explore by topic → Submit a link → About us →
