Download the PHP package disrex/stylesmuggler-adobe-patches-mageos without Composer

On this page you can find all versions of the php package disrex/stylesmuggler-adobe-patches-mageos. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.

FAQ

After the download, you have to make one include require_once('vendor/autoload.php');. After that you have to import the classes with use statements.

Example:
If you use only one package a project is not needed. But if you use more then one package, without a project it is not possible to import the classes with use statements.

In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
Some PHP packages are not free to download and because of that hosted in private repositories. In this case some credentials are needed to access such packages. Please use the auth.json textarea to insert credentials, if a package is coming from a private repository. You can look here for more information.

  • Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
  • To use Composer is sometimes complicated. Especially for beginners.
  • Composer needs much resources. Sometimes they are not available on a simple webspace.
  • If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
  • Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Please rate this library. Is it a good library?

Informations about the package stylesmuggler-adobe-patches-mageos

disrex/stylesmuggler-adobe-patches-mageos

composer require delivery of Adobe's official APSB26-146 fix (CVE-2026-75650, internal reference VULN-39341) for Mage-OS stores, applied through cweagans/composer-patches.

This is the Mage-OS companion to disrex/stylesmuggler-adobe-patches (that one is for Magento Open Source). Use this one only on Mage-OS.

Prefer a Mage-OS release with the fix. Mage-OS ships its own security releases. If one that contains the APSB26-146 fix is available for your line, update to it instead. This package is for a Mage-OS store that must patch in place until then.

Install

There is one release per Mage-OS line, keyed on mage-os/product-community-edition. Composer picks the one matching your installed Mage-OS version.

Release (tag) Mage-OS version Magento equivalent
2.4.6 >=1.0.0 <1.0.3 2.4.6
2.4.7 >=1.0.3 <1.1.0 2.4.7
2.4.8 >=1.1.0 <3.0.0 2.4.8
2.4.9 >=3.0.0 <4.0.0 2.4.9

Tested, and not tested

These are Adobe's Magento patches, applied to Mage-OS's packages. The files they touch are identical between Magento and Mage-OS at the levels we checked: the framework patch applies cleanly to mage-os/framework 2.3.0 (Magento 2.4.8-p5) and 3.4.0 (Magento 2.4.9), and neither carried the fix already.

Other Mage-OS versions and the non-framework packages are not individually tested. This is safe: patches apply through git apply, which is strict. It applies only where the surrounding lines match exactly, and refuses otherwise; it cannot land a security patch in the wrong place. Keep "composer-exit-on-patch-failure": true so a refusal stops your deploy with a clear message. If it refuses, update to a Mage-OS release with the fix.

Prerequisites

It will not touch your Mage-OS

composer require never downgrades or reinstalls an installed, locked package on its own. The release for your line accepts the version you already run, so Composer keeps Mage-OS exactly where it is and only adds this metapackage and cweagans/composer-patches. A version with no matching release fails and reverts rather than changing anything.

What it applies

Adobe's fix for CVE-2026-75650 (CWE-1336, template-engine injection, CVSS 10.0), keyed on mage-os/framework, mage-os/module-backend, mage-os/module-email, mage-os/module-newsletter and mage-os/magento2-base. The patch files are Adobe's VULN-39341, repackaged by yellowteak, referenced by URL with sha256. The patch content is Adobe's, not covered by this package's MIT license.

After patching a store that was exposed

Patching shuts the door; it does not evict an attacker who already got in or invalidate secrets they read. Rotate the encryption key, database and admin credentials, API tokens and payment-gateway keys, and work through the cleanup guide in the mitigation repo.

Credits

The fix is Adobe's (APSB26-146). The composer-patches repackaging is yellowteak's. Discovery and the original advisory belong to Sansec.

All versions of stylesmuggler-adobe-patches-mageos with dependencies

PHP Build Version
Package Version
Requires cweagans/composer-patches Version ^1.7.3 || ^2.0
mage-os/product-community-edition Version >=3.0.0 <4.0.0
Composer command for our command line client (download client) This client runs in each environment. You don't need a specific PHP version etc. The first 20 API calls are free. Standard composer command

The package disrex/stylesmuggler-adobe-patches-mageos contains the following files

Loading the files please wait ...