PT-2026-33803 · Adobe · Magento

Published 2026-04-20 · Updated 2026-04-28 · CVE-2026-40488

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Magento Long Term Support (LTS) versions prior to 20.17.0

Description The product custom option file upload feature uses an incomplete blocklist forbidden extensions = php,exe to prevent dangerous file uploads. This restriction can be bypassed by using alternative PHP-executable extensions such as .phtml, .phar, .php3, .php4, .php5, .php7, and .pht. Uploaded files are stored in the publicly accessible 'media/custom options/quote/' directory. In configurations where this directory lacks server-side execution restrictions, it allows Remote Code Execution (RCE), which is the ability of an attacker to execute arbitrary commands on the target server.

Recommendations Update to version 20.17.0.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2026-40488

GHSA-3J5Q-7Q7H-2HHV

Affected Products

Magento

References · 9

• 🔥 https://github.com/OpenMage/magento-lts/security/advisories/GHSA-3j5q-7q7h-2hhv · Exploit
• https://osv.dev/vulnerability/GHSA-3j5q-7q7h-2hhv · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40488 · Security Note
• https://github.com/OpenMage/magento-lts · Note
• https://twitter.com/infoflowcloud/status/2046572978817687785 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1ssnpas/resumen_diario_de_vulnerabilidades_22042026 · Reddit Post
• https://reddit.com/r/VulnMatter/comments/1ssjoms/resumen_diario_de_vulnerabilidades_22042026 · Reddit Post
• https://twitter.com/CVEnew/status/2046571925519155428 · Twitter Post
• https://twitter.com/_cvereports/status/2049063850092236969 · Twitter Post