CVE-2026-53787 is an unauthenticated arbitrary file upload vulnerability in Amasty Order Attributes for Magento 2 prior to version 4.0.0. The vulnerability allows attackers to submit files of any type or name to the upload endpoint without authentication, session validation, or cart context. Uploaded files are written to the store's media directory, which may permit execution of malicious PHP files, enabling remote code execution. Additionally, attackers can use this to host malware, perform stored cross-site scripting via HTML or SVG files, or conduct path traversal to write files outside the intended directory.

Successful exploitation allows unauthenticated attackers to upload arbitrary files, including executable PHP scripts, leading to remote code execution on affected servers. This can compromise the entire Magento store environment. Other impacts include malware hosting, stored cross-site scripting attacks, and unauthorized file writes outside the designated upload directory.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict or disable file uploads via the vulnerable endpoint and ensure the media directory does not allow execution of uploaded files, particularly PHP. Monitor for suspicious files in the media directory and apply strict file type validation and access controls as temporary mitigations.