Read the docs
TI-2021-12425 Aliases CVE-2021-32758GHSA-26rr-v2j2-25fh

Layout XML Arbitrary Code Fix

Priority LOW 36CWE-91Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

OpenMage Magento LTS is an alternative to the Magento CE official releases. Prior to versions 19.4.15 and 20.0.11, layout XML enabled admin users to execute arbitrary commands via block methods. The latest OpenMage Versions up from v19.4.15 and v20.0.11 have this Issue patched.

Why it matters now

EPSS 0.02009 80th percentileScored 2026-11-07
Fix Fixed magento-lts (OpenMage): 19.4.15, 20.0.11openmage/magento-lts (Packagist): 19.4.15, 20.0.13

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
OpenMagemagento-ltsbefore 19.4.15; 20 to before 20.0.1119.4.15, 20.0.11Patch availableCNA
—openmage/magento-lts (Packagist)before 19.4.1519.4.15Patch availableGHSA-26rr-v2j2-25fh
—openmage/magento-lts (Packagist)20.0.0 to before 20.0.1320.0.13Patch availableGHSA-26rr-v2j2-25fh
  • magento-lts VendorOpenMage Affected before 19.4.15; 20 to before 20.0.11 Fixed in 19.4.15, 20.0.11 Patch available CNA
  • openmage/magento-lts (Packagist) Vendor— Affected before 19.4.15 Fixed in 19.4.15 Patch available GHSA-26rr-v2j2-25fh
  • openmage/magento-lts (Packagist) Vendor— Affected 20.0.0 to before 20.0.13 Fixed in 20.0.13 Patch available GHSA-26rr-v2j2-25fh

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:openmage:openmage:*:*:*:*:lts:*:*:*before 19.4.15; 20.0.00 to before 20.0.11VulnerableOpenMage
  • cpe:2.3:a:openmage:openmage:*:*:*:*:lts:*:*:* Versions before 19.4.15; 20.0.00 to before 20.0.11 Vulnerable ·OpenMage

Remediation

  • Fix · CNA magento-lts (OpenMage) Fixed in 19.4.15, 20.0.11
  • Fix · GHSA-26rr-v2j2-25fh openmage/magento-lts (Packagist) Fixed in 19.4.15 Advisory →
  • Fix · GHSA-26rr-v2j2-25fh openmage/magento-lts (Packagist) Fixed in 20.0.13 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-32758
  2. 2026-10-03 Alias added: GHSA-26rr-v2j2-25fh

References

Advisory 4

Other 2

  • TI-2020-16106 Widget instances allows a hacker to inject an executable file on the server on OpenMage CVSS 3.1HIGH 8.7
  • TI-2020-16116 CMS Editor code execution CVSS 3.1HIGH 8.7
  • TI-2020-16073 Layout XML RCE Vulnerability in OpenMage CVSS 3.1HIGH 8.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences