AIKIDO-2026-572808

TL;DR

Guest-cart REST endpoints such as POST /V1/guest-carts/:cartId/items process product_option file_info uploads without verifying that the option ID exists on the product, that the option is file-typed, or that the filename extension is safe. An unauthenticated attacker who knows a product SKU can therefore write a polyglot image-plus-PHP payload under pub/media/custom_options/quote/ with an attacker-controlled name (for example .php / .phtml / .phar). When the web server executes PHP in that directory, the upload becomes remote code execution; even when execution is blocked, the file persists on disk. This issue is exploited in the wild, and public exploit tooling is available. The fix introduces ImageContentProcessor extension validation (via NotProtectedExtension) during custom-option file processing so dangerous extensions are rejected before the file is saved.