Exploitation Summary
CVE-2025-54236 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added October 24, 2025.
EIP tracks 7 public exploits from researchers including wubinworks, brito101, Jenderal92, including a Metasploit module exploits/multi/http/magento_sessionreaper.
A Nuclei detection template is also available.
AI-analyzed exploit summary This repository provides a patch for CVE-2025-54236 (Session Reaper) in Magento 2, which allows customer account takeover and RCE under certain conditions. The patch is implemented as a Magento 2 extension and includes detailed technical analysis and mitigation code.
Description
Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality, and integrity impact to high. Exploitation of this issue does not require user interaction.
Exploits (7)
This repository provides a patch for CVE-2025-54236 (Session Reaper) in Magento 2, which allows customer account takeover and RCE under certain conditions. The patch is implemented as a Magento 2 extension and includes detailed technical analysis and mitigation code.
This repository contains a functional exploit for CVE-2025-54236, targeting a PHP object deserialization vulnerability in Magento 2 / Adobe Commerce. The exploit leverages multiple deserialization vectors to achieve remote code execution by manipulating session storage paths and uploading malicious serialized session files.
This repository contains a functional exploit for CVE-2025-54236, targeting a file upload vulnerability in Magento. The script automates the upload of a text file to a vulnerable endpoint and verifies its accessibility, demonstrating unauthorized file upload capabilities.
This repository contains a functional Python PoC for CVE-2025-54236, a PHP object deserialization vulnerability in Magento 2 / Adobe Commerce leading to unauthenticated RCE. It implements three distinct deserialization vectors via REST API endpoints to exploit improper input validation in ServiceInputProcessor.
This repository contains a functional exploit for CVE-2025-54236, targeting a deserialization vulnerability in Magento 2.4.x/Adobe Commerce. The exploit leverages a Monolog gadget chain to achieve remote code execution (RCE) via crafted input in the 'region' or 'extension_attributes' fields of a guest cart request.
This repository contains a functional exploit PoC for CVE-2025-54236, demonstrating improper validation of nested JSON leading to remote command execution. The exploit leverages a vulnerable PHP API endpoint that processes nested JSON input without proper sanitization, allowing arbitrary command execution via the 'payload.cmd' field.
This Metasploit module exploits CVE-2025-54236, a critical unauthenticated RCE vulnerability in Magento/Adobe Commerce via deserialization and file upload. It chains unauthenticated session file upload with REST API manipulation to achieve remote code execution.
Nuclei Templates (1)
X-Magento-Tags
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N