PT-2026-6440 · Packagist · Openmage Magento Lts

Publicado 2026-02-02 · Atualizado 2026-02-02

OSV

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Impact

The admin url can be discovered without prior knowledge of it's location by exploiting the X-Original-Url header on some configurations.

Patches

The bug comes from the Zend library and is patche by unsetting the header in the bootstrap process.

Workarounds

Unset the X-Original-Url header in the web server configuration.

References

The activation of these headers is coming from the Zend Controller module. It appears this has been known to some degree since 2016 - https://peterocallaghan.co.uk/2016/12/magento-poisoning-cache/ (dead link now..)

Credit

Anees Hyder ( @anees0xdev ) via HackerOne https://hackerone.com/anees0x dev/hacktivity

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

GHSA-JG68-VHV3-9R8F

Produtos afetados

Openmage Magento Lts

Referências · 5

• https://github.com/OpenMage/magento-lts · Nota
• https://github.com/OpenMage/magento-lts/security/advisories/GHSA-jg68-vhv3-9r8f · Nota
• https://hackerone.com/bugs?subject=openmage&report_id=3416312 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-25523 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-jg68-vhv3-9r8f · Aviso do Fabricante