TI-2021-17982 Aliases CVE-2021-41143 GHSA-5vpv-xmcj-9q85

OpenMage LTS arbitrary file deletion in customer media allows for remote code execution

LOW 36CWE-77Published 2023-01-27 · Updated 2025-03-10

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-77.

Summary

OpenMage LTS is an e-commerce platform. Prior to versions 19.4.22 and 20.0.19, Magento admin users with access to the customer media could execute code on the server. Versions 19.4.22 and 20.0.19 contain a patch for this issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.01346 71st percentileScored 2026-11-07

Fix Fixed magento-lts (OpenMage): 19.4.22, 20.0.19openmage/magento-lts (Packagist): 19.4.22, 20.0.19

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
OpenMage	magento-lts	before 19.4.22; 20.0.0 to before 20.0.19	19.4.22, 20.0.19	Patch available	CNA
—	openmage/magento-lts (Packagist)	before 19.4.22	19.4.22	Patch available	GHSA-5vpv-xmcj-9q85
—	openmage/magento-lts (Packagist)	20.0.0 to before 20.0.19	20.0.19	Patch available	GHSA-5vpv-xmcj-9q85

magento-lts VendorOpenMage Affected before 19.4.22; 20.0.0 to before 20.0.19 Fixed in 19.4.22, 20.0.19 Patch available CNA
openmage/magento-lts (Packagist) Vendor— Affected before 19.4.22 Fixed in 19.4.22 Patch available GHSA-5vpv-xmcj-9q85
openmage/magento-lts (Packagist) Vendor— Affected 20.0.0 to before 20.0.19 Fixed in 20.0.19 Patch available GHSA-5vpv-xmcj-9q85

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:openmage:magento:::::lts:::*	before 19.4.22; 20.0.0 to before 20.0.19	Vulnerable	OpenMage

cpe:2.3:a:openmage:magento:*:*:*:*:lts:*:*:* Versions before 19.4.22; 20.0.0 to before 20.0.19 Vulnerable ·OpenMage

Remediation

Fix · CNA magento-lts (OpenMage) Fixed in 19.4.22, 20.0.19
Fix · GHSA-5vpv-xmcj-9q85 openmage/magento-lts (Packagist) Fixed in 19.4.22 Advisory →
Fix · GHSA-5vpv-xmcj-9q85 openmage/magento-lts (Packagist) Fixed in 20.0.19 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2021-41143
2026-10-03 Alias added: GHSA-5vpv-xmcj-9q85

References

Patch 1

https://github.com/OpenMage/magento-lts/commit/45330ff50439984e806992fa22c3f96c4d660f91

Advisory 4

Other 1

https://github.com/OpenMage/magento-lts

TI-2026-20633 OpenMage LTS's Phar Deserialization leads to Remote Code Execution CVSS 3.1HIGH 8.1
TI-2026-29239 OpenMage LTS has Customer File Upload Extension Blocklist Bypass that Leads to Remote Code Execution CVSS 4.0HIGH 8.7
TI-2023-22272 Magento LTS's guest order "protect code" can be brute-forced too easily CVSS 3.1HIGH 7.5
TI-2026-28925 Missing authorization in OpenMage magento-lts CVSS 4.0MEDIUM 5.3
TI-2026-20634 OpenMage LTS has Path Traversal Filter Bypass in Dataflow Module CVSS 3.1MEDIUM 4.9
TI-2025-39617 OpenMage is vulnerable to XSS in Admin Notifications CVSS 4.0MEDIUM 4.6

See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences