PT-2026-33803 · Openmage · Magento-Lts

Published 2026-04-20 · Updated 2026-04-20 · CVE-2026-40488

Mitre

CVSS v4.0

8.7

High

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Prior to version 20.17.0, the product custom option file upload in OpenMage LTS uses an incomplete blocklist (forbidden extensions = php,exe) to prevent dangerous file uploads. This blocklist can be trivially bypassed by using alternative PHP-executable extensions such as .phtml, .phar, .php3, .php4, .php5, .php7, and .pht. Files are stored in the publicly accessible media/custom options/quote/ directory, which lacks server-side execution restrictions for some configurations, enabling Remote Code Execution if this directory is not explicitly denied script execution. Version 20.17.0 patches the issue.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2026-40488

Affected Products

Magento-Lts

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-40488 · Security Note
• https://github.com/OpenMage/magento-lts/security/advisories/GHSA-3j5q-7q7h-2hhv · Note