Vulnerabilidades de Openmage
CVEs publicadas que afetam produtos de Openmage: 9 registro(s), com severidade, exploração e correções.
CVE-2026-42458
Média · 5.3
CWE-87 15/05/2026
Magento LTS: Reflected XSS - Import -> Data Flow (profiles)
Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Prior to 20.18.0, there is a reflected XSS vulnerability under admin panel -> System -> Import/Export -> Dataflow - Profiles. This vulnerability is fixed in 20.18.0.
CVE-2026-42207
Média · 6.1
CWE-601 15/05/2026
Magento LTS: Open Redirect via Unvalidated `uenc` Parameter in `stockAction()` - magento-lts
Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Prior to 20.18.0, Mage_ProductAlert_AddController::stockAction() reads the uenc query parameter and passes it directly to $this->_redirectUrl($backUrl) without calling $this->_isUrlInternal(). When the supplied product_id does not match any catalog product, the server issues an unvalidated HTTP 302 redirect to whatever URL was provided as uenc. This vulnerability is fixed in 20.18.0.
CVE-2026-42155
Crítica · 9.3
CWE-330 15/05/2026
OpenMage Magento-lts: IDs de sessão de API previsíveis (CWE-330)
O Magento Long Term Support (LTS) é um projeto não oficial e impulsionado pela comunidade que oferece uma alternativa à edição Community do Magento, com alto nível de compatibilidade retroativa. Antes da versão 20.18.0, o ID de sessão da API XML-RPC / SOAP é gerado com uma construção antiga, baseada em tempo, em vez de um Gerador de Números Pseudoaleatórios Criptograficamente Seguro (CSPRNG). Todas as entradas do hash MD5 são derivadas do tempo e não são seguras. Como o resultado depende inteiramente do timestamp e do estado do LCG interno do PHP, a entropia efetiva fica severamente limitada. Isso viola o requisito do OWASP ASVS v4 de ≥ 64 bits de entropia (V3.2.2) e os padrões do NIST SP 800-63B. Ao restringir a janela do LCG (por meio de vazamentos de estado do servidor ou de previsibilidade geral) e explorar a ausência de limitação de taxa na API, um atacante pode gerar um conjunto localizado de hashes MD5 candidatos e executar um ataque de força bruta online de alta velocidade para sequestrar sessões de API ativas. Esta vulnerabilidade está corrigida na versão 20.18.0.
CVE-2026-40488
Alta · 8.8
CWE-434 20/04/2026
OpenMage LTS has Customer File Upload Extension Blocklist Bypass that Leads to Remote Code Execution
Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Prior to version 20.17.0, the product custom option file upload in OpenMage LTS uses an incomplete blocklist (`forbidden_extensions = php,exe`) to prevent dangerous file uploads. This blocklist can be trivially bypassed by using alternative PHP-executable extensions such as `.phtml`, `.phar`, `.php3`, `.php4`, `.php5`, `.php7`, and `.pht`. Files are stored in the publicly accessible `media/custom_options/quote/` directory, which lacks server-side execution restrictions for some configurations, enabling Remote Code Execution if this directory is not explicitly denied script execution. Version 20.17.0 patches the issue.
CVE-2026-40098
Média · 5.4
CWE-862 20/04/2026
OpenMage LTS imports cross-user wishlist item via shared wishlist code, leading to private option disclosure and file-disclosure variant
Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Prior to version 20.17.0, the shared wishlist add-to-cart endpoint authorizes access with a public `sharing_code`, but loads the acted-on wishlist item by a separate global `wishlist_item_id` and never verifies that the item belongs to the shared wishlist referenced by that code. This lets an attacker use a valid shared wishlist code for wishlist A and a wishlist item ID belonging to victim wishlist B to import victim item B into the attacker's cart through the shared wishlist flow for wishlist A. Because the victim item's stored `buyRequest` is reused during cart import, the victim's private custom-option data is copied into the attacker's quote. If the product uses a file custom option, this can be elevated to cross-user file disclosure because the imported file metadata is preserved and the download endpoint is not ownership-bound. Version 20.17.0 patches the issue.
CVE-2026-25525
Média · 4.9
CWE-22 20/04/2026
OpenMage LTS has Path Traversal Filter Bypass in Dataflow Module
Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Prior to version 20.17.0, the Dataflow module in OpenMage LTS uses a weak blacklist filter (`str_replace('../', '', $input)`) to prevent path traversal attacks. This filter can be bypassed using patterns like `..././` or `....//`, which after the replacement still result in `../`. An authenticated administrator can exploit this to read arbitrary files from the server filesystem. Version 20.17.0 patches the issue.
CVE-2026-25524
Alta · 8.1
CWE-502 20/04/2026
OpenMage LTS's Phar Deserialization leads to Remote Code Execution
Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Prior to version 20.17.0, PHP functions such as `getimagesize()`, `file_exists()`, and `is_readable()` can trigger deserialization when processing `phar://` stream wrapper paths. OpenMage LTS uses these functions with potentially controllable file paths during image validation and media handling. An attacker who can upload a malicious phar file (disguised as an image) and trigger one of these functions with a `phar://` path can achieve arbitrary code execution. Version 20.17.0 patches the issue.
CVE-2026-25523
Média · 5.3
CWE-200 04/02/2026
Magento's X-Original-Url header can expose admin url
Magento-lts is a long-term support alternative to Magento Community Edition (CE). Prior to version 20.16.1, the admin url can be discovered without prior knowledge of it's location by exploiting the X-Original-Url header on some configurations. This issue has been patched in version 20.16.1.
CVE-2025-64174
Média · 4.8
CWE-79 06/11/2025
OpenMage is vulnerable to XSS in Admin Notifications
Magento-lts is a long-term support alternative to Magento Community Edition (CE). Versions 20.15.0 and below are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an admin with direct database access or the admin notification feed source to inject malicious scripts into vulnerable fields. Unescaped translation strings and URLs are printed into contexts inside app/code/core/Mage/Adminhtml/Block/Notification/Grid/Renderer/Actions.php. A malicious translation or polluted data can inject script. This issue is fixed in version 20.16.0.