Read the docs
TI-2021-12426 Aliases CVE-2021-32759GHSA-xm9f-vxmx-4m58

Data Flow Sanitation Issue Fix

Priority LOW 35CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

OpenMage magento-lts is an alternative to the Magento CE official releases. Due to missing sanitation in data flow in versions prior to 19.4.15 and 20.0.13, it was possible for admin users to upload arbitrary executable files to the server. OpenMage versions 19.4.15 and 20.0.13 have a patch for this Issue.

Why it matters now

EPSS 0.01797 78th percentileScored 2026-11-07
Fix Fixed magento-lts (OpenMage): 19.4.15, 20.0.13openmage/magento-lts (Packagist): 19.4.15, 20.0.13

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
OpenMagemagento-ltsbefore 19.4.15; 20 to before 20.0.1319.4.15, 20.0.13Patch availableCNA
—openmage/magento-lts (Packagist)before 19.4.1519.4.15Patch availableGHSA-xm9f-vxmx-4m58
—openmage/magento-lts (Packagist)20.0.0 to before 20.0.1320.0.13Patch availableGHSA-xm9f-vxmx-4m58
  • magento-lts VendorOpenMage Affected before 19.4.15; 20 to before 20.0.13 Fixed in 19.4.15, 20.0.13 Patch available CNA
  • openmage/magento-lts (Packagist) Vendor— Affected before 19.4.15 Fixed in 19.4.15 Patch available GHSA-xm9f-vxmx-4m58
  • openmage/magento-lts (Packagist) Vendor— Affected 20.0.0 to before 20.0.13 Fixed in 20.0.13 Patch available GHSA-xm9f-vxmx-4m58

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:openmage:magento:*:*:*:*:*:*:*:*before 19.4.13; 20.0.0 to before 20.0.11VulnerableOpenMage
  • cpe:2.3:a:openmage:magento:*:*:*:*:*:*:*:* Versions before 19.4.13; 20.0.0 to before 20.0.11 Vulnerable ·OpenMage

Remediation

  • Fix · CNA magento-lts (OpenMage) Fixed in 19.4.15, 20.0.13
  • Fix · GHSA-xm9f-vxmx-4m58 openmage/magento-lts (Packagist) Fixed in 19.4.15 Advisory →
  • Fix · GHSA-xm9f-vxmx-4m58 openmage/magento-lts (Packagist) Fixed in 20.0.13 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-32759
  2. 2026-10-03 Alias added: GHSA-xm9f-vxmx-4m58

References

Patch 2

Advisory 2

Other 1

  • TI-2026-20633 OpenMage LTS's Phar Deserialization leads to Remote Code Execution CVSS 3.1HIGH 8.1
  • TI-2026-29239 OpenMage LTS has Customer File Upload Extension Blocklist Bypass that Leads to Remote Code Execution CVSS 4.0HIGH 8.7
  • TI-2023-22272 Magento LTS's guest order "protect code" can be brute-forced too easily CVSS 3.1HIGH 7.5
  • TI-2026-28925 Missing authorization in OpenMage magento-lts CVSS 4.0MEDIUM 5.3
  • TI-2026-20634 OpenMage LTS has Path Traversal Filter Bypass in Dataflow Module CVSS 3.1MEDIUM 4.9
  • TI-2025-39617 OpenMage is vulnerable to XSS in Admin Notifications CVSS 4.0MEDIUM 4.6
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences