AUTOMATED No executable code in media or upload paths

Why it Matters

Magento media and upload paths are often writable by the application and publicly reachable. If PHP, PHTML, or other executable server-side files can run from these directories, an upload flaw can become remote code execution.

Blocking execution in writable public paths reduces the chance that an attacker can plant a web shell and use it to modify checkout, steal secrets, or skim payment pages.

Verification Steps

find pub/media var -type f \( -iname "*.php" -o -iname "*.phtml" -o -iname "*.phar" \) 2>/dev/null

Remediation / Fix Guidance

1. Remove executable files from media and upload directories after confirming they are not legitimate.
2. Configure the web server to deny PHP/PHTML execution in writable public paths.
3. Validate upload handlers with extension allowlists and MIME checks.
4. Store risky uploads outside webroot where possible.
5. Monitor writable paths for new executable files.

Examples

pub/media/catalog/tmp/shell.php
# PHP file present in public upload path → FAIL

location ~* ^/media/.*\.php$ { deny all; }
# Execution blocked → PASS

References

• OWASP Top 10 — A05: Security Misconfiguration
• OWASP Top 10 — A08: Software and Data Integrity Failures