PT-2026-33797 · Openmage · Openmage

Published 2026-04-20 · Updated 2026-04-21 · CVE-2026-25525

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenMage LTS versions prior to 20.17.0

Description The Dataflow module uses a weak blacklist filter to prevent path traversal. The filter uses str replace('../','', $input), which can be bypassed using patterns such as ..././ or ....// because the replacement is only performed in a single pass. An authenticated administrator can exploit this by manipulating the files parameter to read arbitrary files from the server filesystem.

Recommendations Update to version 20.17.0. As a temporary workaround, disable the Dataflow module if it is not in use. Restrict access to the Dataflow module to trusted administrators only.

Exploit

Fix

Path traversal

Incomplete List of Disallowed Inputs

Weakness Enumeration

CWE-22

CWE-184

Related Identifiers

CVE-2026-25525

GHSA-6VQF-6FHM-7RC6

Affected Products

Openmage

References · 10

• 🔥 https://github.com/OpenMage/magento-lts/security/advisories/GHSA-6vqf-6fhm-7rc6 · Exploit
• https://osv.dev/vulnerability/GHSA-6vqf-6fhm-7rc6 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25525 · Security Note
• https://github.com/OpenMage/magento-lts · Note
• https://github.com/OpenMage/magento-lts/pull/5445 · Note
• https://github.com/OpenMage/magento-lts/releases/tag/v20.17.0 · Note
• https://twitter.com/CVEnew/status/2046571930392969245 · Twitter Post
• https://twitter.com/infoflowcloud/status/2046573042336170404 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2046366994803347815 · Twitter Post
• https://hackerone.com/reports/3482926 · Note