TI-2021-16602 Aliases CVE-2021-39217 GHSA-c9q3-r4rv-mjm7

OpenMage LTS arbitrary command execution in custom layout update through blocks

LOW 36CWE-77Published 2023-01-27 · Updated 2025-03-10

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-77.

Summary

OpenMage LTS is an e-commerce platform. Prior to versions 19.4.22 and 20.0.19, Custom Layout enabled admin users to execute arbitrary commands via block methods. Versions 19.4.22 and 20.0.19 contain patches for this issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.01379 72nd percentileScored 2026-11-07

Fix Fixed magento-lts (OpenMage): 19.4.22, 20.0.19openmage/magento-lts (Packagist): 19.4.22, 20.0.19

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
OpenMage	magento-lts	before 19.4.22; 20.0.0 to before 20.0.19	19.4.22, 20.0.19	Patch available	CNA
—	openmage/magento-lts (Packagist)	before 19.4.22	19.4.22	Patch available	GHSA-c9q3-r4rv-mjm7
—	openmage/magento-lts (Packagist)	20.0.0 to before 20.0.19	20.0.19	Patch available	GHSA-c9q3-r4rv-mjm7

magento-lts VendorOpenMage Affected before 19.4.22; 20.0.0 to before 20.0.19 Fixed in 19.4.22, 20.0.19 Patch available CNA
openmage/magento-lts (Packagist) Vendor— Affected before 19.4.22 Fixed in 19.4.22 Patch available GHSA-c9q3-r4rv-mjm7
openmage/magento-lts (Packagist) Vendor— Affected 20.0.0 to before 20.0.19 Fixed in 20.0.19 Patch available GHSA-c9q3-r4rv-mjm7

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:openmage:magento:::::lts:::*	before 19.4.22; 20.0.0 to before 20.0.19	Vulnerable	OpenMage

cpe:2.3:a:openmage:magento:*:*:*:*:lts:*:*:* Versions before 19.4.22; 20.0.0 to before 20.0.19 Vulnerable ·OpenMage

Remediation

Fix · CNA magento-lts (OpenMage) Fixed in 19.4.22, 20.0.19
Fix · GHSA-c9q3-r4rv-mjm7 openmage/magento-lts (Packagist) Fixed in 19.4.22 Advisory →
Fix · GHSA-c9q3-r4rv-mjm7 openmage/magento-lts (Packagist) Fixed in 20.0.19 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2021-39217
2026-10-03 Alias added: GHSA-c9q3-r4rv-mjm7

References

Patch 1

https://github.com/OpenMage/magento-lts/commit/289bd4b4f53622138e3e5c2d2cef7502d780086f

Advisory 4

Other 1

https://github.com/OpenMage/magento-lts

TI-2026-20633 OpenMage LTS's Phar Deserialization leads to Remote Code Execution CVSS 3.1HIGH 8.1
TI-2026-29239 OpenMage LTS has Customer File Upload Extension Blocklist Bypass that Leads to Remote Code Execution CVSS 4.0HIGH 8.7
TI-2023-22272 Magento LTS's guest order "protect code" can be brute-forced too easily CVSS 3.1HIGH 7.5
TI-2026-28925 Missing authorization in OpenMage magento-lts CVSS 4.0MEDIUM 5.3
TI-2026-20634 OpenMage LTS has Path Traversal Filter Bypass in Dataflow Module CVSS 3.1MEDIUM 4.9
TI-2025-39617 OpenMage is vulnerable to XSS in Admin Notifications CVSS 4.0MEDIUM 4.6

See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences