Openmage vulnerabilities, page 2
27 vulnerabilities
Known vulnerabilities in Openmage products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 4 products.
MediumCVE-2026-42207openmage · magento-ltsMagento LTS: Open Redirect via Unvalidated `uenc` Parameter in `stockAction()` - magento-ltsMagento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Prior to 20.18.0, Mage_ProductAlert_AddController::stockAction() reads the uenc query parameter and passes it directly to $this->_redirectUrl($backUrl) without calling $this->_isUrlInternal(). When the supplied product_id does not match any catalog product, the server issues an unvalidated HTTP 302 redirect to whatever URL was provided as uenc. This vulnerability is fixed in 20.18.0.EPSS0.24%MediumCVE-2026-42458openmage · magento-ltsMagento LTS: Reflected XSS - Import -> Data Flow (profiles)Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Prior to 20.18.0, there is a reflected XSS vulnerability under admin panel -> System -> Import/Export -> Dataflow - Profiles. This vulnerability is fixed in 20.18.0.EPSS0.44%MediumCVE-2026-25525openmage · magento +1 moreOpenMage LTS has Path Traversal Filter Bypass in Dataflow ModuleMagento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Prior to version 20.17.0, the Dataflow module in OpenMage LTS uses a weak blacklist filter (`str_replace('../', '', $input)`) to prevent path traversal attacks. This filter can be bypassed using patterns like `..././` or `....//`, which after the replacement still result in `../`. An authenticated administrator can exploit this to read arbitrary files from the server filesystem. Version 20.17.0 patches the issue.EPSS0.65%HighCVE-2026-25524openmage · magento +1 moreOpenMage LTS's Phar Deserialization leads to Remote Code ExecutionMagento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Prior to version 20.17.0, PHP functions such as `getimagesize()`, `file_exists()`, and `is_readable()` can trigger deserialization when processing `phar://` stream wrapper paths. OpenMage LTS uses these functions with potentially controllable file paths during image validation and media handling. An attacker who can upload a malicious phar file (disguised as an image) and trigger one of these functions with a `phar://` path can achieve arbitrary code execution. Version 20.17.0 patches the issue.EPSS0.71%MediumCVE-2026-25523openmage · magento +1 moreMagento's X-Original-Url header can expose admin urlMagento-lts is a long-term support alternative to Magento Community Edition (CE). Prior to version 20.16.1, the admin url can be discovered without prior knowledge of it's location by exploiting the X-Original-Url header on some configurations. This issue has been patched in version 20.16.1.EPSS0.43%HighCVE-2023-41879openmage · magento +1 moreMagento LTS's guest order "protect code" can be brute-forced too easilyMagento LTS is the official OpenMage LTS codebase. Guest orders may be viewed without authentication using a "guest-view" cookie which contains the order's "protect_code". This code is 6 hexadecimal characters which is arguably not enough to prevent a brute-force attack. Exposing each order would require a separate brute force attack. This issue has been patched in versions 19.5.1 and 20.1.1.EPSS1.25%HighCVE-2023-23617openmage · magento +1 moreOpenMage LTS has DoS vulnerability in MaliciousCode filterOpenMage LTS is an e-commerce platform. Versions prior to 19.4.22 and 20.0.19 contain an infinite loop in malicious code filter in certain conditions. Versions 19.4.22 and 20.0.19 have a fix for this issue. There are no known workarounds.EPSS0.99%