psf-magento-check(8)

Script: /opt/psf-security-patches/magento/magento-check.sh. Tool page: Magento and Adobe Commerce. Source. With the package installed: man psf-magento-check.

Magento, Adobe Commerce and Mage-OS email-template RCE (BlockStrap): read-only checker  (v3)
CVE-2026-103849

If this software is helpful, consider a donation to our 501c3 nonprofit:
https://privacysafe.foundation

CVE-2026-103849 (BlockStrap) is an unauthenticated remote code execution flaw in the email
template engine, CVSS 10.0 (CVSS 3.1). It is a second-pass directive injection: a directive
hidden in a child email template is signed, passes the check, and is processed again by the
parent template. Adobe's fix is in APSB26-153 (13 October 2026). Researchers found four attack
paths within a day and expect exploitation; none was confirmed at the time of the sources
used here.

  Affected: Adobe Commerce 2.4.4 to 2.4.9, Adobe Commerce B2B 1.3.3 to 1.5.3 and Magento
            Open Source (sources give 2.4.6 or 2.4.7 as the first) to 2.4.9, in builds
            before APSB26-153. Mage-OS up to and including 3.5.0.
  Fixed:    Adobe's October 2026 releases (APSB26-153); Mage-OS 3.6.0 (14 October 2026).

What a version number can and cannot show. Adobe ships this fix as an isolated patch, and
applying it does not change the version string. So for Magento and Adobe Commerce the script
tells you what to check rather than guessing. It can give a
firm answer for Mage-OS (the fix arrives as a release) and for a dated release string if your
build uses one (for example 2.4.9-2026-oct).

No indicators of exploitation have been published for this flaw, so there is no hunt.

This script is read-only.

Usage:
  ./magento-check.sh [command] [DIR ...]
  check (default)  find installs by bin/magento (default /var/www /srv /home /opt),
                   read the distribution and version from composer.lock. Exit 0 = nothing
                   exposed, 1 = exposed or unconfirmed.
  version          print the script version.
Containers: with no directory argument the check also copies the files it reads from running
docker and podman containers (SCAN_CONTAINERS=1, the default; 0 skips them) and judges them like
host installs. The copies are temporary: a path shown as .../docker_NAME_PATH is the PATH inside
the container NAME.

The Security Patches software and this documentation are dedicated to the public domain under CC0 1.0 Universal. Other pages on privacysafe.app/docs are CC BY-SA 4.0 unless the page says otherwise.