Content management and web applications

Magento, Adobe Commerce and Mage-OS email-template RCE: BlockStrap (CVE-2026-103849)

Magento email-template RCE check

CVE-2026-103849 ("BlockStrap") is an unauthenticated remote code execution flaw in the email template engine, rated CVSS 10.0 (CVSS 3.1). It is a second-pass directive injection: a directive hidden in a child email template is signed, passes the check, and is processed again by the parent template. Researchers found four attack paths within a day of disclosure and expect exploitation. None was confirmed in the sources used for this document.

What a version number can and cannot show

Adobe ships this fix as an isolated patch, and applying it does not change the version string, so a store on 2.4.8-p5 or 2.4.9 may or may not be fixed. The script therefore does not guess for Magento and Adobe Commerce: it tells you which patch to confirm. It gives a firm answer where the version can carry one:

The distribution and version are read from composer.lock (the mage-os/product-community-edition, magento/product-enterprise-edition or magento/product-community-edition package), and from composer.json on a git checkout.

Quick start

curl -fLO https://raw.githubusercontent.com/PrivacySafe/security-patches/refs/heads/main/magento/magento-check.sh
less magento-check.sh
chmod +x magento-check.sh
./magento-check.sh check

By default it looks for bin/magento under /var/www /srv /home /opt. Pass directories to narrow it. Everything is read-only.

There is no hunt

No indicators of exploitation have been published for this flaw, so the script has none. A clean check shows that the version is fixed, not that the store was never attacked.

Update

Apply the APSB26-153 fix or move to the October 2026 release for your line, or to Mage-OS 3.6.0.

If a store was exposed

Review your email templates for directives you did not add. That suggestion is the project's, not Adobe's.

Sources

• Sansec: BlockStrap
• BleepingComputer: BlockStrap
• Adobe security bulletin APSB26-153

Before you run it

• The fix. Apply Adobe's APSB26-153 fix or move to the October 2026 release for your line, or to Mage-OS 3.6.0. Adobe documents no workaround.
• A version number cannot show this fix. Adobe ships it as an isolated patch that does not change the version string, so for Magento and Adobe Commerce the script tells you which patch to confirm. It gives a firm answer for Mage-OS and for a dated release string such as 2.4.9-2026-oct.
• A Mage-OS pre-release is not the release. 3.6.0-beta1 and 3.6.0-rc2 are reported with a warning, not as fixed.
• There is no hunt. No indicators of exploitation have been published for this flaw.
• It also checks running docker and podman containers, unless you name a directory or set SCAN_CONTAINERS=0. The check finds installs inside running docker and podman containers by their marker file, copies only the files it reads into a private temporary directory, and judges them like a host install. A path shown as .../docker_NAME_PATH is the PATH inside the container NAME. It never runs anything in a container beyond find and a file copy, never copies .env or wp-config.php, never keeps a staged symlink, and is skipped when you name directories yourself.

The Security Patches software and this documentation are dedicated to the public domain under CC0 1.0 Universal. Other pages on privacysafe.app/docs are CC BY-SA 4.0 unless the page says otherwise.

Edit this page on Codeberg