# CVE-2026-53787: Order Attributes For Magento 2 - Path Traversal

> Live exploitation tracking for CVE-2026-53787 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2026-53787

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 9.3
- **Public exploit available:** Yes
- **Affected products:** Amasty Order Attributes For Magento 2
- **Weaknesses:** CWE-434 (Unrestricted Upload of File with Dangerous Type)
- **Tags:** ecommerce, php

## Description

Amasty Order Attributes For Magento 2 before version 4.0.0 contains an unauthenticated arbitrary file upload vulnerability that allows unauthenticated attackers to write arbitrary files to the store's media directory by submitting files of any type or name to the upload endpoint without authentication, session validation, or cart context. Attackers can upload PHP files to achieve remote code execution on servers where the media directory permits PHP execution, or alternatively enable malware hosting, stored cross-site scripting via HTML or SVG uploads, and path traversal to write files outside the intended upload directory.

## CrowdSec analysis

[CVE-2026-53787](https://euvd.enisa.europa.eu/vulnerability/CVE-2026-53787) is a critical vulnerability in Amasty Order Attributes For Magento 2 prior to version 4.0.0, allowing unauthenticated attackers to upload arbitrary files to the store's media directory. This flaw can be exploited to achieve remote code execution by uploading malicious PHP files, host malware, perform stored cross-site scripting via HTML or SVG files, or leverage path traversal to write files outside the intended directory. The vulnerability poses a severe risk to affected Magento 2 stores, potentially leading to full server compromise and data breaches.

CrowdSec has been tracking this vulnerability and its exploits since 24th of June 2026.

Data from the CrowdSec community indicates that exploitation of CVE-2026-53787 is highly selective and intelligence-driven. Threat actors use advanced reconnaissance and carefully choose their targets, often as part of sophisticated campaigns or advanced persistent threat operations.
CrowdSec network telemetry also shows that exploitation of CVE-2026-53787 has significantly declined over the past week. Attack volumes are well below the long-term average, suggesting attackers are rapidly losing interest. The vulnerability appears to be falling out of active use across most threat landscapes.

Attackers exploit unauthenticated POST requests to endpoints such as `/rest/V1/amasty_orderattr/uploadFile`, `/rest/all/V1/amasty_orderattr/uploadFile`, and `/rest/default/V1/amasty_orderattr/uploadFile` to upload arbitrary files, enabling remote code execution or malware hosting on Magento 2 sites running vulnerable Amasty Order Attributes versions.

## Timeline

- 2026-06-12: CVE Published. CVE-2026-53787 is published to NVD.
- 2026-06-24: Rule Released. CrowdSec releases a rule to detect CVE-2026-53787 exploitation attempts against the CrowdSec Network.
- 2026-06-25: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2026-53787 for the first time.

## References

- https://sansec.io/research/amasty-order-attributes-file-upload
- https://www.vulncheck.com/advisories/amasty-order-attributes-for-magento-2-unauthenticated-arbitrary-file-upload
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-53787.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2026-53787) follows observed exploitation activity for CVE-2026-53787. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.