File upload functionality in Magento — customer file uploads, media management, import file processing, and storage handling.
Defense-in-depth module that blocks the PolyShell unrestricted file upload attack with layered checks: request/media path blocking, strict filename/extension validation, and polyglot content detection. Provides Composer install steps, admin-configurable allow/block lists, logging, and migration from markshust/polyshell-patch.
21 Apr 2026
A Magento 2 security module that disables the unauthenticated customer address file upload endpoint to protect against CVE-2025-54236 (SessionReaper) and related file upload vulnerabilities.
14 Nov 2025
Since Searchlight Cyber published a technical write up and proof-of-concept for the SessionReaper vulnerability, attackers have been mass scanning Magento / Adobe Commerce stores for vulnerable targets. The first phase of the attack involves uploading a payload containing malicious session data to the server.
11 Nov 2025