Read the docs
TI-2020-16106 Aliases CVE-2020-26285

Widget instances allows a hacker to inject an executable file on the server on OpenMage

Priority MEDIUM 44CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-434.

Summary

OpenMage is a community-driven alternative to Magento CE. In OpenMage before versions 19.4.10 and 20.0.5, there is a vulnerability which enables remote code execution. In affected versions an administrator with permission to import/export data and to create widget instances was able to inject an executable file on the server. The latest OpenMage Versions up from 19.4.9 and 20.0.5 have this Issue solved

Why it matters now

EPSS 0.03723 89th percentileScored 2026-11-07
Fix Fixed magento-lts (OpenMage): 19.4.10, 20.0.5

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
OpenMagemagento-ltsbefore 19.4.10; 20.0.0 to before 20.0.519.4.10, 20.0.5Patch availableCNA
  • magento-lts VendorOpenMage Affected before 19.4.10; 20.0.0 to before 20.0.5 Fixed in 19.4.10, 20.0.5 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:openmage:openmage:*:*:*:*:lts:*:*:*before 19.4.10; 20.0.0 to before 20.0.5VulnerableOpenMage
  • cpe:2.3:a:openmage:openmage:*:*:*:*:lts:*:*:* Versions before 19.4.10; 20.0.0 to before 20.0.5 Vulnerable ·OpenMage

Remediation

  • Fix · CNA magento-lts (OpenMage) Fixed in 19.4.10, 20.0.5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-26285

References

Patch 1

Advisory 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences