CVE-2026-128046

EUVD-2026-125062

13.11.2026, 10:18

OpenMage magento-lts 20.17.0 before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an unrestricted file upload vulnerability because the general/file/protected_extensions blocklist omits phar, php8, and phps. Unauthenticated attackers can upload a .phar file through a product File custom option to a predictable media/custom_options path and request it directly to execute code on servers that map .phar to PHP and serve that directory.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	8.1 HIGH	NETWORK	HIGH	NONE	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Awaiting analysis

This vulnerability is currently awaiting analysis.

Base Score

CVSS 3.x

EPSS Score

Percentile: 54.01%

Common Weakness Enumeration

CWE-184 - Incomplete List of Disallowed Inputs
The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete, leading to resultant weaknesses.

References

https://github.com/OpenMage/magento-lts/commit/5b6f985785245a964aa3dc78609f6af44d9d5e27

https://github.com/OpenMage/magento-lts/commit/ba76b2346fe1e380f39c23e68ccb818d7324d24f

https://github.com/OpenMage/magento-lts/commit/dd692b825ba50f196bcc20ae67fbed48dd95da56

https://github.com/OpenMage/magento-lts/security/advisories/GHSA-4fxg-469f-r6fc

https://www.vulncheck.com/advisories/openmage-magento-lts-20.17.0-before-20.18.2-unrestricted-file-upload-rce-via-custom-options