aregowe/magento2-module-polyshell-protection
Comprehensive defense-in-depth module that closes the PolyShell unrestricted file upload vulnerability (APSB25-94) in Adobe Commerce and Magento Open Source.
1.3.5
124K downloads/mo
#4142 most downloaded on Packagist
aregowe/magento2-module-polyshell-protection
What this package is like to depend on
Last release 19 days ago
04 Aug 2026
Release timing varies
gaps range from 8 days to 3 months
Some releases are documented
notes for 6 of 11 stable releases
Nothing withdrawn
no release was ever pulled
4 months old
11 releases · first in 2026
11 releases in the last 12 months
see the full history below
Release timeline
11 releases · Apr 2026 to Aug 2026Releases
latest 11-
1.3.504 Aug 2026Release notes
Open source →What's Changed
- Fix false positives on legit image uploads by @arnoudhgz in #19
New Contributors
- @arnoudhgz made their first contribution in #19
Full Changelog: v1.3.4...v1.3.5
-
1.3.423 Apr 2026Release notes
Open source →Fix #12 (follow-up): the v1.3.3 fix split the PHP payload string via concatenation but the explanatory comment still quoted the literal webshell signature verbatim, which Sansec eComscan's eval_post_91ce4 rule pattern-matches without context. The comment has been rewritten to describe the rationale without reproducing the signature.
-
1.3.322 Apr 2026Release notes
Open source →Fix #12: avoid eComscan false positive by obfuscating attack-simulation payloads in test fixtures.
-
1.3.221 Apr 2026Nothing published for this version
-
1.3.120 Apr 2026Release notes
Open source →What's Changed
- Add
.inc,.module,.phpsto blocked extension patterns andBASE_BLOCKED_EXTENSIONShash map - Closes double-extension bypass where files like
file.inc.pngorfile.module.gifpassedBLOCKED_EXTENSION_PATTERN - These extensions are server-executable in common web server configurations (Apache, PHP-FPM)
- Updated admin panel blocked extensions display, README, and copilot instructions
Fixes #4
- Add
-
1.2.120 Apr 2026Release notes
Open source →Fix
- Support Magento Open Source (Community Edition) — skip test for Adobe Commerce-only class
AbstractUploadFilewhen not present (#2) - Add Magento composer repository to
composer.jsonfor dependency resolution
- Support Magento Open Source (Community Edition) — skip test for Adobe Commerce-only class
-
1.2.018 Apr 2026Nothing published for this version
-
1.1.014 Apr 2026Release notes
Open source →- Fully integrates markshust/magento2-module-polyshell-patch logic
- Adds composer replace directive for automatic migration
- Adds comprehensive unit tests for extension allowlist coverage
- Updates README with migration guide and attribution to Mark Shust
-
1.0.214 Apr 2026Nothing published for this version
-
1.0.114 Apr 2026Nothing published for this version
-
1.0.014 Apr 2026Nothing published for this version