CVE-2026-40488 PUBLISHED

OpenMage LTS has Customer File Upload Extension Blocklist Bypass that Leads to Remote Code Execution

Assigner: GitHub_M
Reserved: 13.04.2026 Published: 20.04.2026 Updated: 20.04.2026

Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Prior to version 20.17.0, the product custom option file upload in OpenMage LTS uses an incomplete blocklist (forbidden_extensions = php,exe) to prevent dangerous file uploads. This blocklist can be trivially bypassed by using alternative PHP-executable extensions such as .phtml, .phar, .php3, .php4, .php5, .php7, and .pht. Files are stored in the publicly accessible media/custom_options/quote/ directory, which lacks server-side execution restrictions for some configurations, enabling Remote Code Execution if this directory is not explicitly denied script execution. Version 20.17.0 patches the issue.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS Score: 8.7

Product Status

Vendor OpenMage
Product magento-lts
Versions
  • Version < 20.17.0 is affected

References

Problem Types

  • CWE-434: Unrestricted Upload of File with Dangerous Type CWE