Read the docs
TI-2020-16073 Aliases CVE-2020-26252

Layout XML RCE Vulnerability in OpenMage

Priority MEDIUM 42CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-434.

Summary

OpenMage is a community-driven alternative to Magento CE. In OpenMage before versions 19.4.10 and 20.0.6, there is a vulnerability which enables remote code execution. In affected versions an administrator with permission to update product data to be able to store an executable file on the server and load it via layout xml. The latest OpenMage Versions up from 19.4.10 and 20.0.6 have this issue solved.

Why it matters now

EPSS 0.02146 82nd percentileScored 2026-11-07
Fix Fixed magento-lts (OpenMage): 19.4.10, 20.0.6

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
OpenMagemagento-ltsbefore 19.4.10; 20 to before 20.0.619.4.10, 20.0.6Patch availableCNA
  • magento-lts VendorOpenMage Affected before 19.4.10; 20 to before 20.0.6 Fixed in 19.4.10, 20.0.6 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:openmage:openmage:*:*:*:*:lts:*:*:*before 19.4.10; 20.0.0 to before 20.0.6VulnerableOpenMage
  • cpe:2.3:a:openmage:openmage:*:*:*:*:lts:*:*:* Versions before 19.4.10; 20.0.0 to before 20.0.6 Vulnerable ·OpenMage

Remediation

  • Fix · CNA magento-lts (OpenMage) Fixed in 19.4.10, 20.0.6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-26252

References

Patch 1

Advisory 1

  • TI-2020-16106 Widget instances allows a hacker to inject an executable file on the server on OpenMage CVSS 3.1HIGH 8.7
  • TI-2020-16116 CMS Editor code execution CVSS 3.1HIGH 8.7
  • TI-2021-12425 Layout XML Arbitrary Code Fix CVSS 3.1HIGH 7.2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences