Order Attributes For Magento 2 - Path Traversal (CVE-2026-53787)

CVE-2026-53787 is a critical vulnerability in Amasty Order Attributes For Magento 2 prior to version 4.0.0, allowing unauthenticated attackers to upload arbitrary files to the store's media directory. This flaw can be exploited to achieve remote code execution by uploading malicious PHP files, host malware, perform stored cross-site scripting via HTML or SVG files, or leverage path traversal to write files outside the intended directory. The vulnerability poses a severe risk to affected Magento 2 stores, potentially leading to full server compromise and data breaches.

CrowdSec has been tracking this vulnerability and its exploits since 24th of June 2026.

Data from the CrowdSec community indicates that exploitation of CVE-2026-53787 is highly selective and intelligence-driven. Threat actors use advanced reconnaissance and carefully choose their targets, often as part of sophisticated campaigns or advanced persistent threat operations. CrowdSec network telemetry also shows that exploitation of CVE-2026-53787 has significantly declined over the past week. Attack volumes are well below the long-term average, suggesting attackers are rapidly losing interest. The vulnerability appears to be falling out of active use across most threat landscapes.

Attackers exploit unauthenticated POST requests to endpoints such as /rest/V1/amasty_orderattr/uploadFile, /rest/all/V1/amasty_orderattr/uploadFile, and /rest/default/V1/amasty_orderattr/uploadFile to upload arbitrary files, enabling remote code execution or malware hosting on Magento 2 sites running vulnerable Amasty Order Attributes versions.