Read the docs
TI-2020-16116 Aliases CVE-2020-26295

CMS Editor code execution

Priority MEDIUM 42CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-434.

Summary

OpenMage is a community-driven alternative to Magento CE. In OpenMage before versions 19.4.10 and 20.0.5, an administrator with permission to import/export data and to edit cms pages was able to inject an executable file on the server via layout xml. The latest OpenMage Versions up from 19.4.9 and 20.0.5 have this Issue solved

Why it matters now

EPSS 0.02239 82nd percentileScored 2026-11-07
Fix Fixed magento-lts (OpenMage): 19.4.10, 20.0.6

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
OpenMagemagento-ltsbefore 19.4.10; 20.0.0 to before 20.0.619.4.10, 20.0.6Patch availableCNA
  • magento-lts VendorOpenMage Affected before 19.4.10; 20.0.0 to before 20.0.6 Fixed in 19.4.10, 20.0.6 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:openmage:openmage:*:*:*:*:lts:*:*:*before 19.4.10; 20.0.0 to before 20.0.5VulnerableOpenMage
  • cpe:2.3:a:openmage:openmage:*:*:*:*:lts:*:*:* Versions before 19.4.10; 20.0.0 to before 20.0.5 Vulnerable ·OpenMage

Remediation

  • Fix · CNA magento-lts (OpenMage) Fixed in 19.4.10, 20.0.6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-26295

References

Patch 1

Advisory 2

  • TI-2020-16106 Widget instances allows a hacker to inject an executable file on the server on OpenMage CVSS 3.1HIGH 8.7
  • TI-2020-16073 Layout XML RCE Vulnerability in OpenMage CVSS 3.1HIGH 8.7
  • TI-2021-12425 Layout XML Arbitrary Code Fix CVSS 3.1HIGH 7.2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences